├── PermissionManager ├── .gitignore ├── .idea │ ├── .gitignore │ ├── compiler.xml │ ├── gradle.xml │ └── misc.xml ├── app │ ├── .gitignore │ ├── appKey.jks │ ├── build.gradle │ ├── proguard-rules.pro │ └── src │ │ ├── androidTest │ │ └── java │ │ │ └── com │ │ │ └── linux │ │ │ └── permissionmanager │ │ │ └── ExampleInstrumentedTest.java │ │ ├── main │ │ ├── AndroidManifest.xml │ │ ├── cpp │ │ │ ├── CMakeLists.txt │ │ │ ├── cJSON.cpp │ │ │ ├── cJSON.h │ │ │ ├── native-lib.cpp │ │ │ ├── root.cpp │ │ │ └── urlEncodeUtils.h │ │ ├── java │ │ │ └── com │ │ │ │ └── linux │ │ │ │ └── permissionmanager │ │ │ │ ├── Adapter │ │ │ │ ├── SelectAppRecyclerAdapter.java │ │ │ │ └── SelectFileRecyclerAdapter.java │ │ │ │ ├── MainActivity.java │ │ │ │ ├── Model │ │ │ │ ├── PopupWindowOnTouchClose.java │ │ │ │ ├── SelectAppRecyclerItem.java │ │ │ │ └── SelectFileRecyclerItem.java │ │ │ │ └── Utils │ │ │ │ ├── DialogUtils.java │ │ │ │ └── ScreenInfoUtils.java │ │ └── res │ │ │ ├── drawable-v24 │ │ │ └── ic_launcher_foreground.xml │ │ │ ├── drawable │ │ │ ├── ic_launcher_background.xml │ │ │ ├── line.xml │ │ │ ├── line_drawable.xml │ │ │ ├── ripple_grey.xml │ │ │ ├── shape_wnd_grey_corner.xml │ │ │ ├── thumb.xml │ │ │ └── thumb_drawable.xml │ │ │ ├── layout │ │ │ ├── activity_main.xml │ │ │ ├── select_app_recycler_item.xml │ │ │ ├── select_app_wnd.xml │ │ │ ├── select_file_recycler_item.xml │ │ │ └── select_file_wnd.xml │ │ │ ├── mipmap-anydpi-v26 │ │ │ ├── ic_launcher.xml │ │ │ └── ic_launcher_round.xml │ │ │ ├── mipmap-hdpi │ │ │ ├── ic_launcher.webp │ │ │ └── ic_launcher_round.webp │ │ │ ├── mipmap-mdpi │ │ │ ├── ic_launcher.webp │ │ │ └── ic_launcher_round.webp │ │ │ ├── mipmap-xhdpi │ │ │ ├── ic_launcher.webp │ │ │ └── ic_launcher_round.webp │ │ │ ├── mipmap-xxhdpi │ │ │ ├── ic_launcher.webp │ │ │ └── ic_launcher_round.webp │ │ │ ├── mipmap-xxxhdpi │ │ │ ├── ic_launcher.webp │ │ │ └── ic_launcher_round.webp │ │ │ ├── values-night │ │ │ └── themes.xml │ │ │ └── values │ │ │ ├── colors.xml │ │ │ ├── strings.xml │ │ │ └── themes.xml │ │ └── test │ │ └── java │ │ └── com │ │ └── linux │ │ └── permissionmanager │ │ └── ExampleUnitTest.java ├── build.gradle ├── build_apk │ └── PermissionManager.apk ├── gradle.properties ├── gradle │ └── wrapper │ │ ├── gradle-wrapper.jar │ │ └── gradle-wrapper.properties ├── gradlew ├── gradlew.bat └── settings.gradle ├── README.md ├── ScreenCap ├── 1.png ├── 3.png └── 4.png ├── patch_kernel_root ├── 3rdparty │ ├── capstone-4.0.2-win64 │ │ ├── CREDITS.TXT │ │ ├── ChangeLog │ │ ├── LICENSE.TXT │ │ ├── LICENSE_LLVM.TXT │ │ ├── README.md │ │ ├── RELEASE_NOTES │ │ ├── SPONSORS.TXT │ │ ├── capstone.dll │ │ ├── capstone.lib │ │ ├── capstone_dll.lib │ │ ├── cstool.exe │ │ └── include │ │ │ ├── capstone │ │ │ ├── arm.h │ │ │ ├── arm64.h │ │ │ ├── capstone.h │ │ │ ├── evm.h │ │ │ ├── m680x.h │ │ │ ├── m68k.h │ │ │ ├── mips.h │ │ │ ├── platform.h │ │ │ ├── ppc.h │ │ │ ├── sparc.h │ │ │ ├── systemz.h │ │ │ ├── tms320c64x.h │ │ │ ├── x86.h │ │ │ └── xcore.h │ │ │ ├── platform.h │ │ │ └── windowsce │ │ │ ├── intrin.h │ │ │ └── stdint.h │ └── find_mrs_register.h ├── analyze │ ├── ARM_asm.h │ ├── base_func.h │ ├── kallsyms_lookup_name.cpp │ ├── kallsyms_lookup_name.h │ ├── kallsyms_lookup_name_4_6_0.cpp │ ├── kallsyms_lookup_name_4_6_0.h │ ├── kallsyms_lookup_name_6_1_42.cpp │ ├── kallsyms_lookup_name_6_1_42.h │ ├── kallsyms_lookup_name_6_1_60.cpp │ ├── kallsyms_lookup_name_6_1_60.h │ ├── kallsyms_lookup_name_6_6_30.cpp │ ├── kallsyms_lookup_name_6_6_30.h │ ├── kernel_symbol_parser.cpp │ ├── kernel_symbol_parser.h │ ├── kernel_version_parser.cpp │ ├── kernel_version_parser.h │ ├── symbol_analyze.cpp │ └── symbol_analyze.h ├── exe │ ├── aarch64-linux-android-as.exe │ ├── arm-linux-androideabi-as.exe │ ├── patch_kernel_root.exe │ └── 快速扩充文件体积工具 │ │ ├── QuicklyExpandFileSize.cpp │ │ ├── QuicklyExpandFileSize128M.exe │ │ ├── QuicklyExpandFileSize192M.exe │ │ ├── QuicklyExpandFileSize64.exe │ │ ├── QuicklyExpandFileSize96.exe │ │ └── 用法：将kernel文件拖拽至exe ├── patch_avc_denied.cpp ├── patch_avc_denied.h ├── patch_base.cpp ├── patch_base.h ├── patch_do_execve.cpp ├── patch_do_execve.h ├── patch_filldir64.cpp ├── patch_filldir64.h ├── patch_freeze_task.cpp ├── patch_freeze_task.h ├── patch_kernel_root.cpp ├── patch_kernel_root.h ├── patch_kernel_root.vcxproj ├── patch_kernel_root.vcxproj.filters └── patch_kernel_root.vcxproj.user └── testRoot └── jni ├── Android.mk ├── Application.mk ├── Build.bat ├── Clean.bat ├── kernel_root_kit ├── file_convert_to_source_tools │ ├── file_convert_to_source_tools.cpp │ └── file_convert_to_source_tools.exe ├── kernel_root_kit_command.h ├── kernel_root_kit_elf64_symbol_parser.h ├── kernel_root_kit_err_def.h ├── kernel_root_kit_exec_process.h ├── kernel_root_kit_fork_helper.h ├── kernel_root_kit_lib_root_server_data.h ├── kernel_root_kit_lib_su_env_data.h ├── kernel_root_kit_log.h ├── kernel_root_kit_maps_helper.h ├── kernel_root_kit_parasite_app.cpp ├── kernel_root_kit_parasite_app.h ├── kernel_root_kit_parasite_elf_def.h ├── kernel_root_kit_parasite_patch_elf.cpp ├── kernel_root_kit_parasite_patch_elf.h ├── kernel_root_kit_process64_inject.cpp ├── kernel_root_kit_process64_inject.h ├── kernel_root_kit_process_cmdline_utils.h ├── kernel_root_kit_ptrace_arm64_utils.cpp ├── kernel_root_kit_ptrace_arm64_utils.h ├── kernel_root_kit_random.h ├── kernel_root_kit_su_exec_data.h ├── kernel_root_kit_su_install_helper.cpp ├── kernel_root_kit_su_install_helper.h ├── kernel_root_kit_umbrella.h ├── kernel_root_kit_upx_data.h ├── kernel_root_kit_upx_helper.cpp └── kernel_root_kit_upx_helper.h ├── lib_root_server ├── file_to_gzip │ ├── file_to_gzip.cpp │ ├── file_to_gzip.exe │ ├── file_to_gzip.sln │ ├── file_to_gzip.vcxproj │ ├── file_to_gzip.vcxproj.filters │ ├── file_to_gzip.vcxproj.user │ └── zlib-1.3.1 │ │ ├── adler32.c │ │ ├── compress.c │ │ ├── crc32.c │ │ ├── crc32.h │ │ ├── deflate.c │ │ ├── deflate.h │ │ ├── gzclose.c │ │ ├── gzguts.h │ │ ├── gzlib.c │ │ ├── gzread.c │ │ ├── gzwrite.c │ │ ├── infback.c │ │ ├── inffast.c │ │ ├── inffast.h │ │ ├── inffixed.h │ │ ├── inflate.c │ │ ├── inflate.h │ │ ├── inftrees.c │ │ ├── inftrees.h │ │ ├── trees.c │ │ ├── trees.h │ │ ├── uncompr.c │ │ ├── zconf.h │ │ ├── zlib.h │ │ ├── zutil.c │ │ └── zutil.h ├── generate_source_lib_root_server_data.bat ├── generate_source_lib_root_server_html_data.bat ├── index.html ├── index_html_gz_data.h ├── jni │ ├── Android.mk │ └── Application.mk ├── lib_root_server.cpp ├── lib_root_server.h └── lib_root_server_inline.h ├── lib_su_env ├── generate_source_lib_su_env_data.bat ├── jni │ ├── Android.mk │ └── Application.mk ├── lib_su_env.cpp └── lib_su_env_inline.h ├── su ├── generate_source_su_exec_data.bat ├── jni │ ├── Android.mk │ └── Application.mk ├── su.cpp ├── su.h ├── su_encryptor.h ├── su_hide_path_utils.h └── su_log.h ├── testRoot.cpp ├── testRoot.h ├── upx ├── generate_source_upx_data.bat └── upx-5.0.1-arm64_linux │ ├── COPYING │ ├── LICENSE │ ├── NEWS │ ├── README │ ├── THANKS.txt │ ├── upx │ ├── upx-doc.html │ ├── upx-doc.txt │ └── upx.1 ├── utils ├── cJSON.cpp ├── cJSON.h ├── jsonUtils.h ├── randomData.h └── stringUtils.h └── 编译流程.txt /PermissionManager/.gitignore: -------------------------------------------------------------------------------- 1 | *.iml 2 | .gradle 3 | /local.properties 4 | /.idea/caches 5 | /.idea/libraries 6 | /.idea/modules.xml 7 | /.idea/workspace.xml 8 | /.idea/navEditor.xml 9 | /.idea/assetWizardSettings.xml 10 | .DS_Store 11 | /build 12 | /captures 13 | .externalNativeBuild 14 | .cxx 15 | local.properties 16 | -------------------------------------------------------------------------------- /PermissionManager/.idea/.gitignore: -------------------------------------------------------------------------------- 1 | # Default ignored files 2 | /shelf/ 3 | /workspace.xml 4 | -------------------------------------------------------------------------------- /PermissionManager/.idea/compiler.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /PermissionManager/.idea/gradle.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 19 | 20 | -------------------------------------------------------------------------------- /PermissionManager/.idea/misc.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 26 | 27 | 28 | 29 | 30 | 31 | 33 | -------------------------------------------------------------------------------- /PermissionManager/app/.gitignore: -------------------------------------------------------------------------------- 1 | /build -------------------------------------------------------------------------------- /PermissionManager/app/appKey.jks: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/PermissionManager/app/appKey.jks -------------------------------------------------------------------------------- /PermissionManager/app/build.gradle: -------------------------------------------------------------------------------- 1 | plugins { 2 | id 'com.android.application' 3 | } 4 | 5 | android { 6 | compileSdk 31 7 | 8 | defaultConfig { 9 | applicationId "com.linux.permissionmanager" 10 | minSdk 26 11 | targetSdk 31 12 | versionCode 1 13 | versionName "1.0" 14 | 15 | testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner" 16 | externalNativeBuild { 17 | cmake { 18 | cppFlags '-std=c++17' 19 | abiFilters "arm64-v8a" //需要什么构架的so，就在这边添加即 20 | } 21 | } 22 | } 23 | 24 | buildTypes { 25 | release { 26 | minifyEnabled false 27 | proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro' 28 | } 29 | } 30 | compileOptions { 31 | sourceCompatibility JavaVersion.VERSION_1_8 32 | targetCompatibility JavaVersion.VERSION_1_8 33 | } 34 | externalNativeBuild { 35 | cmake { 36 | path file('src/main/cpp/CMakeLists.txt') 37 | version '3.18.1' 38 | } 39 | } 40 | buildFeatures { 41 | viewBinding true 42 | } 43 | } 44 | 45 | dependencies { 46 | 47 | implementation 'androidx.appcompat:appcompat:1.4.1' 48 | implementation 'com.google.android.material:material:1.5.0' 49 | implementation 'androidx.constraintlayout:constraintlayout:2.1.3' 50 | testImplementation 'junit:junit:4.13.2' 51 | androidTestImplementation 'androidx.test.ext:junit:1.1.3' 52 | androidTestImplementation 'androidx.test.espresso:espresso-core:3.4.0' 53 | } -------------------------------------------------------------------------------- /PermissionManager/app/proguard-rules.pro: -------------------------------------------------------------------------------- 1 | # Add project specific ProGuard rules here. 2 | # You can control the set of applied configuration files using the 3 | # proguardFiles setting in build.gradle. 4 | # 5 | # For more details, see 6 | # http://developer.android.com/guide/developing/tools/proguard.html 7 | 8 | # If your project uses WebView with JS, uncomment the following 9 | # and specify the fully qualified class name to the JavaScript interface 10 | # class: 11 | #-keepclassmembers class fqcn.of.javascript.interface.for.webview { 12 | # public *; 13 | #} 14 | 15 | # Uncomment this to preserve the line number information for 16 | # debugging stack traces. 17 | #-keepattributes SourceFile,LineNumberTable 18 | 19 | # If you keep the line number information, uncomment this to 20 | # hide the original source file name. 21 | #-renamesourcefileattribute SourceFile -------------------------------------------------------------------------------- /PermissionManager/app/src/androidTest/java/com/linux/permissionmanager/ExampleInstrumentedTest.java: -------------------------------------------------------------------------------- 1 | package com.linux.permissionmanager; 2 | 3 | import android.content.Context; 4 | 5 | import androidx.test.platform.app.InstrumentationRegistry; 6 | import androidx.test.ext.junit.runners.AndroidJUnit4; 7 | 8 | import org.junit.Test; 9 | import org.junit.runner.RunWith; 10 | 11 | import static org.junit.Assert.*; 12 | 13 | /** 14 | * Instrumented test, which will execute on an Android device. 15 | * 16 | * @see Testing documentation 17 | */ 18 | @RunWith(AndroidJUnit4.class) 19 | public class ExampleInstrumentedTest { 20 | @Test 21 | public void useAppContext() { 22 | // Context of the app under test. 23 | Context appContext = InstrumentationRegistry.getInstrumentation().getTargetContext(); 24 | assertEquals("com.linux.permissionmanager", appContext.getPackageName()); 25 | } 26 | } -------------------------------------------------------------------------------- /PermissionManager/app/src/main/AndroidManifest.xml: -------------------------------------------------------------------------------- 1 | 2 | 4 | 5 | 12 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | -------------------------------------------------------------------------------- /PermissionManager/app/src/main/cpp/CMakeLists.txt: -------------------------------------------------------------------------------- 1 | # For more information about using CMake with Android Studio, read the 2 | # documentation: https://d.android.com/studio/projects/add-native-code.html 3 | 4 | # Sets the minimum version of CMake required to build the native library. 5 | 6 | cmake_minimum_required(VERSION 3.18.1) 7 | 8 | # Declares and names the project. 9 | 10 | project("permissionmanager") 11 | 12 | # Creates and names a library, sets it as either STATIC 13 | # or SHARED, and provides the relative paths to its source code. 14 | # You can define multiple libraries, and CMake builds them for you. 15 | # Gradle automatically packages shared libraries with your APK. 16 | 17 | add_library( # Sets the name of the library. 18 | permissionmanager 19 | 20 | # Sets the library as a shared library. 21 | SHARED 22 | 23 | # Provides a relative path to your source file(s). 24 | ../../../../../testRoot/jni/kernel_root_kit/kernel_root_kit_process64_inject.cpp 25 | ../../../../../testRoot/jni/kernel_root_kit/kernel_root_kit_ptrace_arm64_utils.cpp 26 | ../../../../../testRoot/jni/kernel_root_kit/kernel_root_kit_su_install_helper.cpp 27 | ../../../../../testRoot/jni/kernel_root_kit/kernel_root_kit_upx_helper.cpp 28 | ../../../../../testRoot/jni/kernel_root_kit/kernel_root_kit_parasite_app.cpp 29 | ../../../../../testRoot/jni/kernel_root_kit/kernel_root_kit_parasite_patch_elf.cpp 30 | cJSON.cpp 31 | native-lib.cpp) 32 | 33 | # Searches for a specified prebuilt library and stores the path as a 34 | # variable. Because CMake includes system libraries in the search path by 35 | # default, you only need to specify the name of the public NDK library 36 | # you want to add. CMake verifies that the library exists before 37 | # completing its build. 38 | 39 | find_library( # Sets the name of the path variable. 40 | log-lib 41 | 42 | # Specifies the name of the NDK library that 43 | # you want CMake to locate. 44 | log) 45 | 46 | # Specifies libraries CMake should link to your target library. You 47 | # can link multiple libraries, such as libraries you define in this 48 | # build script, prebuilt third-party libraries, or system libraries. 49 | 50 | target_link_libraries( # Specifies the target library. 51 | permissionmanager 52 | 53 | # Links the target library to the log library 54 | # included in the NDK. 55 | ${log-lib}) -------------------------------------------------------------------------------- /PermissionManager/app/src/main/cpp/urlEncodeUtils.h: -------------------------------------------------------------------------------- 1 | #ifndef URL_ENCODE_UTILS_H_ 2 | #define URL_ENCODE_UTILS_H_ 3 | #include 4 | #include 5 | 6 | static inline char to_hex(char code) { 7 | static char hex[] = "0123456789ABCDEF"; 8 | return hex[code & 15]; 9 | } 10 | static inline char from_hex(char ch) { 11 | return isdigit(ch) ? ch - '0' : tolower(ch) - 'a' + 10; 12 | } 13 | 14 | /* 15 | //使用例子 16 | int main() { 17 | char str[] = "你好，世界"; 18 | char encoded_str[256]; 19 | url_encode(str, encoded_str); 20 | printf("Encoded URL: %s\n", encoded_str); 21 | return 0; 22 | } 23 | */ 24 | static void url_encode(char *str, char *encoded_str) { 25 | char *pstr = str, *buf = encoded_str; 26 | while (*pstr) { 27 | unsigned char c = *pstr; 28 | if (c <= 0x7F) { // ASCII 29 | if (isalnum(c) || c == '-' || c == '_' || c == '.' || c == '~') { 30 | *buf++ = c; 31 | } else if (c == ' ') { 32 | *buf++ = '+'; 33 | } else { 34 | *buf++ = '%', *buf++ = to_hex(c >> 4), *buf++ = to_hex(c & 15); 35 | } 36 | } else { // Non-ASCII 37 | while (c) { 38 | *buf++ = '%', *buf++ = to_hex(c >> 4), *buf++ = to_hex(c & 15); 39 | c = *(++pstr); 40 | } 41 | continue; 42 | } 43 | pstr++; 44 | } 45 | *buf = '\0'; 46 | } 47 | /* 48 | //使用例子 49 | int main() { 50 | char url[] = "%E4%BD%A0%E5%A5%BD%EF%BC%8C%E4%B8%96%E7%95%8C"; // "你好，世界"的URL编码 51 | char decoded_str[256]; 52 | url_decode(url, decoded_str); 53 | printf("Decoded URL: %s\n", decoded_str); 54 | return 0; 55 | } 56 | */ 57 | static void url_decode(char *str, char *decoded_str) { 58 | char *pstr = str, *buf = decoded_str; 59 | while (*pstr) { 60 | if (*pstr == '%') { 61 | if (pstr[1] && pstr[2]) { 62 | *buf++ = from_hex(pstr[1]) << 4 | from_hex(pstr[2]); 63 | pstr += 2; 64 | } 65 | } else if (*pstr == '+') { 66 | *buf++ = ' '; 67 | } else { 68 | *buf++ = *pstr; 69 | } 70 | pstr++; 71 | } 72 | *buf = '\0'; 73 | } 74 | #endif -------------------------------------------------------------------------------- /PermissionManager/app/src/main/java/com/linux/permissionmanager/Adapter/SelectFileRecyclerAdapter.java: -------------------------------------------------------------------------------- 1 | package com.linux.permissionmanager.Adapter; 2 | 3 | import android.content.Context; 4 | import android.graphics.Color; 5 | import android.os.Handler; 6 | import android.os.Message; 7 | import android.text.Html; 8 | import android.view.LayoutInflater; 9 | import android.view.View; 10 | import android.view.ViewGroup; 11 | import android.widget.ImageView; 12 | import android.widget.PopupWindow; 13 | import android.widget.TextView; 14 | 15 | import androidx.annotation.NonNull; 16 | import androidx.recyclerview.widget.RecyclerView; 17 | 18 | import com.linux.permissionmanager.Model.SelectFileRecyclerItem; 19 | import com.linux.permissionmanager.R; 20 | 21 | import java.util.ArrayList; 22 | import java.util.List; 23 | public class SelectFileRecyclerAdapter extends RecyclerView.Adapter { 24 | public static class ViewHolder extends RecyclerView.ViewHolder { 25 | public View v; 26 | public TextView select_file_name; 27 | public TextView select_file_desc; 28 | public ViewHolder(View v) { 29 | super(v); 30 | this.v = v; 31 | } 32 | } 33 | private int resourceId; 34 | private List objects; 35 | private PopupWindow popupWindow; 36 | private Handler selectFileCallback; 37 | private Context ctx; 38 | public SelectFileRecyclerAdapter(Context ctx, int textViewResourceId, List objects, PopupWindow popupWindow, Handler selectFileCallback) { 39 | this.resourceId = textViewResourceId; 40 | this.objects = new ArrayList<>(objects); 41 | this. popupWindow = popupWindow; 42 | this. selectFileCallback = selectFileCallback; 43 | this. ctx = ctx; 44 | } 45 | 46 | public void updateList(List newList) { 47 | objects.clear(); 48 | objects.addAll(newList); 49 | notifyDataSetChanged(); 50 | } 51 | 52 | 53 | public List getList() { 54 | return objects; 55 | } 56 | 57 | 58 | @NonNull 59 | @Override 60 | public ViewHolder onCreateViewHolder(@NonNull ViewGroup parent, int viewType) { 61 | View v =LayoutInflater.from(parent.getContext()).inflate(resourceId,parent,false); 62 | SelectFileRecyclerAdapter.ViewHolder holder = new SelectFileRecyclerAdapter.ViewHolder(v); 63 | 64 | holder.select_file_name=v.findViewById(R.id.select_file_name) ; 65 | holder.select_file_desc=v.findViewById(R.id.select_file_desc) ; 66 | return holder; 67 | } 68 | 69 | @Override 70 | public void onBindViewHolder(@NonNull ViewHolder holder, int position) { 71 | SelectFileRecyclerItem fileItem=objects.get(position); 72 | String fileName = fileItem.getFileName(); 73 | String fileDesc = fileItem.getFileDesc(); 74 | Color fileDescColor = fileItem.getFileDescColor(); 75 | String hexColor = String.format("#%06X", (0xFFFFFF & fileDescColor.toArgb())); 76 | 77 | String showText=""+fileName +" "; 78 | String showDesc=""+fileDesc +" "; 79 | holder.select_file_name.setText(Html.fromHtml(showText)); 80 | holder.select_file_desc.setText(Html.fromHtml(showDesc)); 81 | 82 | holder.v.setOnClickListener(new ClickRecyclerItemListener(fileItem)); 83 | } 84 | 85 | @Override 86 | public int getItemCount() { 87 | return objects.size(); 88 | } 89 | 90 | @Override 91 | public int getItemViewType(int position) { 92 | return position; 93 | } 94 | 95 | 96 | class ClickRecyclerItemListener implements View.OnClickListener { 97 | SelectFileRecyclerItem fileItem; 98 | public ClickRecyclerItemListener(SelectFileRecyclerItem fileItem){ 99 | this.fileItem =fileItem; 100 | } 101 | @Override 102 | public void onClick(View v) { 103 | popupWindow.dismiss(); 104 | Message msg = new Message(); 105 | msg.obj = (SelectFileRecyclerItem)fileItem; 106 | selectFileCallback.sendMessage(msg); 107 | } 108 | } 109 | } -------------------------------------------------------------------------------- /PermissionManager/app/src/main/java/com/linux/permissionmanager/Model/PopupWindowOnTouchClose.java: -------------------------------------------------------------------------------- 1 | package com.linux.permissionmanager.Model; 2 | 3 | import android.view.MotionEvent; 4 | import android.view.View; 5 | import android.widget.PopupWindow; 6 | 7 | public class PopupWindowOnTouchClose implements View.OnTouchListener { 8 | private boolean lastVailedDown = true; 9 | private int screenWidth, screenHeight, centerWidth, centerHeight; 10 | private PopupWindow popupWindow; 11 | 12 | public PopupWindowOnTouchClose(PopupWindow popupWindow, int screenWidth, int screenHeight, int centerWidth, int centerHeight) { 13 | this.popupWindow = popupWindow; 14 | this.screenWidth = screenWidth; 15 | this.screenHeight = screenHeight; 16 | this.centerWidth = centerWidth; 17 | this.centerHeight = centerHeight; 18 | } 19 | 20 | private boolean isValiedRegion(View v, MotionEvent event) { 21 | int x = (int) event.getX(); 22 | int y = (int) event.getY(); 23 | double wndLeft = (screenWidth - centerWidth) / 2; 24 | double wndTop = (screenHeight - centerHeight) / 2; 25 | if (x < wndLeft || x > wndLeft + centerWidth || y < wndTop || y > wndTop + centerHeight) { 26 | return false; 27 | } 28 | return true; 29 | } 30 | 31 | @Override 32 | public boolean onTouch(View v, MotionEvent event) { 33 | 34 | if (event.getAction() == MotionEvent.ACTION_DOWN) { 35 | lastVailedDown = isValiedRegion(v, event); 36 | } else if (event.getAction() == MotionEvent.ACTION_UP) { 37 | if (!lastVailedDown) { 38 | if (!isValiedRegion(v, event)) { 39 | popupWindow.dismiss(); 40 | } 41 | } 42 | } 43 | return false; 44 | } 45 | } 46 | 47 | 48 | 49 | -------------------------------------------------------------------------------- /PermissionManager/app/src/main/java/com/linux/permissionmanager/Model/SelectAppRecyclerItem.java: -------------------------------------------------------------------------------- 1 | package com.linux.permissionmanager.Model; 2 | 3 | import android.content.Context; 4 | import android.content.pm.PackageInfo; 5 | import android.graphics.drawable.Drawable; 6 | 7 | public class SelectAppRecyclerItem { 8 | private PackageInfo packageInfo; 9 | 10 | public SelectAppRecyclerItem(PackageInfo packageInfo){ 11 | this.packageInfo = packageInfo; 12 | } 13 | 14 | public PackageInfo getPackageInfo() { 15 | return packageInfo; 16 | } 17 | 18 | public String getShowName(Context ctx) { 19 | String showName = this.packageInfo.applicationInfo.loadLabel(ctx.getPackageManager()).toString(); 20 | return showName; 21 | } 22 | public String getPackageName() { 23 | String packageName = this.packageInfo.applicationInfo.packageName; 24 | return packageName; 25 | } 26 | public Drawable getDrawable(Context ctx) { 27 | Drawable icon = this.packageInfo.applicationInfo.loadIcon(ctx.getPackageManager()); 28 | return icon; 29 | } 30 | 31 | } 32 | -------------------------------------------------------------------------------- /PermissionManager/app/src/main/java/com/linux/permissionmanager/Model/SelectFileRecyclerItem.java: -------------------------------------------------------------------------------- 1 | package com.linux.permissionmanager.Model; 2 | 3 | import android.graphics.Color; 4 | import android.os.Build; 5 | 6 | import androidx.annotation.RequiresApi; 7 | 8 | import java.nio.file.Path; 9 | import java.nio.file.Paths; 10 | 11 | public class SelectFileRecyclerItem { 12 | private String filePath; 13 | private String fileDesc; 14 | private Color fileDescColor; 15 | 16 | public SelectFileRecyclerItem(String filePath, String fileDesc, Color fileDescColor){ 17 | this.filePath = filePath; 18 | this.fileDesc = fileDesc; 19 | this.fileDescColor = fileDescColor; 20 | } 21 | 22 | public String getFilePath() { 23 | return this.filePath; 24 | } 25 | 26 | public String getFileName() { 27 | Path path = Paths.get(filePath); 28 | Path fileName = path.getFileName(); 29 | return fileName.toString(); 30 | } 31 | public String getFileDesc() { 32 | return this.fileDesc; 33 | } 34 | public Color getFileDescColor() { 35 | return this.fileDescColor; 36 | } 37 | } 38 | -------------------------------------------------------------------------------- /PermissionManager/app/src/main/java/com/linux/permissionmanager/Utils/DialogUtils.java: -------------------------------------------------------------------------------- 1 | package com.linux.permissionmanager.Utils; 2 | 3 | import android.content.Context; 4 | import android.content.DialogInterface; 5 | import android.graphics.drawable.Drawable; 6 | import android.os.Handler; 7 | import android.os.Message; 8 | import android.widget.EditText; 9 | 10 | import androidx.appcompat.app.AlertDialog; 11 | 12 | public class DialogUtils { 13 | 14 | /** 15 | * 显示带有消息的对话框。 16 | * 17 | * @param context 上下文 18 | * @param title 对话框标题 19 | * @param msg 对话框内容 20 | * @param icon 对话框图标（可为 null） 21 | */ 22 | public static void showMsgDlg(Context context, String title, String msg, Drawable icon) { 23 | AlertDialog.Builder builder = new AlertDialog.Builder(context); 24 | builder.setTitle(title); 25 | builder.setMessage(msg); 26 | if (icon != null) { 27 | builder.setIcon(icon); 28 | } 29 | builder.setPositiveButton("确定", new DialogInterface.OnClickListener() { 30 | public void onClick(DialogInterface dialog, int id) { 31 | dialog.dismiss(); 32 | } 33 | }); 34 | AlertDialog dialog = builder.create(); 35 | dialog.show(); 36 | } 37 | 38 | /** 39 | * 显示带有三个按钮的输入对话框。 40 | * 41 | * @param context 上下文 42 | * @param defaultText 默认文本 43 | * @param title 对话框标题 44 | * @param thirdButtonText 第三个按钮的文本 45 | * @param confirmCallback 点击确定按钮时的回调 46 | * @param thirdButtonCallback 第三个按钮的回调 47 | */ 48 | public static void showInputDlg(Context context, String defaultText, String title, final String thirdButtonText, 49 | final Handler confirmCallback, final Handler thirdButtonCallback) { 50 | final EditText inputTxt = new EditText(context); 51 | inputTxt.setText(defaultText); 52 | inputTxt.setFocusable(true); 53 | inputTxt.setSelection(defaultText.length(), 0); 54 | 55 | AlertDialog.Builder builder = new AlertDialog.Builder(context); 56 | builder.setTitle(title) 57 | .setIcon(android.R.drawable.ic_dialog_info) 58 | .setView(inputTxt) 59 | .setNegativeButton("取消", new DialogInterface.OnClickListener() { 60 | @Override 61 | public void onClick(DialogInterface dialog, int which) { 62 | dialog.dismiss(); 63 | } 64 | }) 65 | .setPositiveButton("确定", new DialogInterface.OnClickListener() { 66 | public void onClick(DialogInterface dialog, int which) { 67 | String text = inputTxt.getText().toString(); 68 | Message msg = new Message(); 69 | msg.obj = text; 70 | confirmCallback.sendMessage(msg); 71 | } 72 | }); 73 | 74 | // 添加第三个按钮 75 | if (thirdButtonText != null && !thirdButtonText.isEmpty()) { 76 | builder.setNeutralButton(thirdButtonText, new DialogInterface.OnClickListener() { 77 | @Override 78 | public void onClick(DialogInterface dialog, int which) { 79 | // 自定义回调 80 | if (thirdButtonCallback != null) { 81 | thirdButtonCallback.sendMessage(new Message()); 82 | } 83 | } 84 | }); 85 | } 86 | 87 | AlertDialog dialog = builder.create(); 88 | dialog.show(); 89 | } 90 | } 91 | -------------------------------------------------------------------------------- /PermissionManager/app/src/main/res/drawable-v24/ic_launcher_foreground.xml: -------------------------------------------------------------------------------- 1 | 7 | 8 | 9 | 15 | 18 | 21 | 22 | 23 | 24 | 30 | -------------------------------------------------------------------------------- /PermissionManager/app/src/main/res/drawable/line.xml: -------------------------------------------------------------------------------- 1 | 2 | 4 | 5 | 6 | 7 | 12 | -------------------------------------------------------------------------------- /PermissionManager/app/src/main/res/drawable/line_drawable.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 6 | 7 | 9 | -------------------------------------------------------------------------------- /PermissionManager/app/src/main/res/drawable/ripple_grey.xml: -------------------------------------------------------------------------------- 1 | 2 | //点击时波纹的颜色 5 | //未点击时控件的背景（可以是图片，可以是颜色，也可以是drawable里的xml背景（比如圆角）） 6 | -------------------------------------------------------------------------------- /PermissionManager/app/src/main/res/drawable/shape_wnd_grey_corner.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 8 | 9 | -------------------------------------------------------------------------------- /PermissionManager/app/src/main/res/drawable/thumb.xml: -------------------------------------------------------------------------------- 1 | 2 | 4 | 5 | 8 | 9 | 10 | 11 | -------------------------------------------------------------------------------- /PermissionManager/app/src/main/res/drawable/thumb_drawable.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 6 | 7 | 9 | -------------------------------------------------------------------------------- /PermissionManager/app/src/main/res/layout/select_app_recycler_item.xml: -------------------------------------------------------------------------------- 1 | 2 | 8 | 9 | 10 | 16 | 17 | 24 | 29 | 30 | 31 | 32 | 33 | 43 | 44 | 50 | 51 | 52 | 53 | 54 | 55 | -------------------------------------------------------------------------------- /PermissionManager/app/src/main/res/layout/select_file_recycler_item.xml: -------------------------------------------------------------------------------- 1 | 2 | 8 | 9 | 10 | 16 | 17 | 27 | 28 | 35 | 36 | 37 | 38 | 39 | 40 | -------------------------------------------------------------------------------- /PermissionManager/app/src/main/res/layout/select_file_wnd.xml: -------------------------------------------------------------------------------- 1 | 2 | 8 | 12 | 13 | 22 | 23 | 31 | 32 | 33 | 40 | 41 | 42 | 43 | 47 | 48 | 49 | 58 | 59 | 60 | 70 | 71 | 72 | 73 | 89 | 90 | 91 | 92 | 93 | 94 | 95 | 96 | -------------------------------------------------------------------------------- /PermissionManager/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | -------------------------------------------------------------------------------- /PermissionManager/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | -------------------------------------------------------------------------------- /PermissionManager/app/src/main/res/mipmap-hdpi/ic_launcher.webp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/PermissionManager/app/src/main/res/mipmap-hdpi/ic_launcher.webp -------------------------------------------------------------------------------- /PermissionManager/app/src/main/res/mipmap-hdpi/ic_launcher_round.webp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/PermissionManager/app/src/main/res/mipmap-hdpi/ic_launcher_round.webp -------------------------------------------------------------------------------- /PermissionManager/app/src/main/res/mipmap-mdpi/ic_launcher.webp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/PermissionManager/app/src/main/res/mipmap-mdpi/ic_launcher.webp -------------------------------------------------------------------------------- /PermissionManager/app/src/main/res/mipmap-mdpi/ic_launcher_round.webp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/PermissionManager/app/src/main/res/mipmap-mdpi/ic_launcher_round.webp -------------------------------------------------------------------------------- /PermissionManager/app/src/main/res/mipmap-xhdpi/ic_launcher.webp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/PermissionManager/app/src/main/res/mipmap-xhdpi/ic_launcher.webp -------------------------------------------------------------------------------- /PermissionManager/app/src/main/res/mipmap-xhdpi/ic_launcher_round.webp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/PermissionManager/app/src/main/res/mipmap-xhdpi/ic_launcher_round.webp -------------------------------------------------------------------------------- /PermissionManager/app/src/main/res/mipmap-xxhdpi/ic_launcher.webp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/PermissionManager/app/src/main/res/mipmap-xxhdpi/ic_launcher.webp -------------------------------------------------------------------------------- /PermissionManager/app/src/main/res/mipmap-xxhdpi/ic_launcher_round.webp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/PermissionManager/app/src/main/res/mipmap-xxhdpi/ic_launcher_round.webp -------------------------------------------------------------------------------- /PermissionManager/app/src/main/res/mipmap-xxxhdpi/ic_launcher.webp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/PermissionManager/app/src/main/res/mipmap-xxxhdpi/ic_launcher.webp -------------------------------------------------------------------------------- /PermissionManager/app/src/main/res/mipmap-xxxhdpi/ic_launcher_round.webp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/PermissionManager/app/src/main/res/mipmap-xxxhdpi/ic_launcher_round.webp -------------------------------------------------------------------------------- /PermissionManager/app/src/main/res/values-night/themes.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 16 | -------------------------------------------------------------------------------- /PermissionManager/app/src/main/res/values/colors.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | #FFBB86FC 4 | #FF6200EE 5 | #FF3700B3 6 | #FF03DAC5 7 | #FF018786 8 | #FF000000 9 | #FFFFFFFF 10 | #424242 11 | #FF767676 12 | #00000000 13 | -------------------------------------------------------------------------------- /PermissionManager/app/src/main/res/values/strings.xml: -------------------------------------------------------------------------------- 1 | 2 | PermissionManager 3 | -------------------------------------------------------------------------------- /PermissionManager/app/src/main/res/values/themes.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 16 | 19 | 22 | 25 | 26 | -------------------------------------------------------------------------------- /PermissionManager/app/src/test/java/com/linux/permissionmanager/ExampleUnitTest.java: -------------------------------------------------------------------------------- 1 | package com.linux.permissionmanager; 2 | 3 | import org.junit.Test; 4 | 5 | import static org.junit.Assert.*; 6 | 7 | /** 8 | * Example local unit test, which will execute on the development machine (host). 9 | * 10 | * @see Testing documentation 11 | */ 12 | public class ExampleUnitTest { 13 | @Test 14 | public void addition_isCorrect() { 15 | assertEquals(4, 2 + 2); 16 | } 17 | } -------------------------------------------------------------------------------- /PermissionManager/build.gradle: -------------------------------------------------------------------------------- 1 | // Top-level build file where you can add configuration options common to all sub-projects/modules. 2 | 3 | task clean(type: Delete) { 4 | delete rootProject.buildDir 5 | } -------------------------------------------------------------------------------- /PermissionManager/build_apk/PermissionManager.apk: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/PermissionManager/build_apk/PermissionManager.apk -------------------------------------------------------------------------------- /PermissionManager/gradle.properties: -------------------------------------------------------------------------------- 1 | # Project-wide Gradle settings. 2 | # IDE (e.g. Android Studio) users: 3 | # Gradle settings configured through the IDE *will override* 4 | # any settings specified in this file. 5 | # For more details on how to configure your build environment visit 6 | # http://www.gradle.org/docs/current/userguide/build_environment.html 7 | # Specifies the JVM arguments used for the daemon process. 8 | # The setting is particularly useful for tweaking memory settings. 9 | org.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8 10 | # When configured, Gradle will run in incubating parallel mode. 11 | # This option should only be used with decoupled projects. More details, visit 12 | # http://www.gradle.org/docs/current/userguide/multi_project_builds.html#sec:decoupled_projects 13 | # org.gradle.parallel=true 14 | # AndroidX package structure to make it clearer which packages are bundled with the 15 | # Android operating system, and which are packaged with your app"s APK 16 | # https://developer.android.com/topic/libraries/support-library/androidx-rn 17 | android.useAndroidX=true 18 | # Automatically convert third-party libraries to use AndroidX 19 | android.enableJetifier=true 20 | # Enables namespacing of each library's R class so that its R class includes only the 21 | # resources declared in the library itself and none from the library's dependencies, 22 | # thereby reducing the size of the R class for that library 23 | android.nonTransitiveRClass=true -------------------------------------------------------------------------------- /PermissionManager/gradle/wrapper/gradle-wrapper.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/PermissionManager/gradle/wrapper/gradle-wrapper.jar -------------------------------------------------------------------------------- /PermissionManager/gradle/wrapper/gradle-wrapper.properties: -------------------------------------------------------------------------------- 1 | #Sat Feb 19 21:34:04 CST 2022 2 | distributionBase=GRADLE_USER_HOME 3 | distributionUrl=https\://services.gradle.org/distributions/gradle-7.2-bin.zip 4 | distributionPath=wrapper/dists 5 | zipStorePath=wrapper/dists 6 | zipStoreBase=GRADLE_USER_HOME 7 | -------------------------------------------------------------------------------- /PermissionManager/gradlew.bat: -------------------------------------------------------------------------------- 1 | @rem 2 | @rem Copyright 2015 the original author or authors. 3 | @rem 4 | @rem Licensed under the Apache License, Version 2.0 (the "License"); 5 | @rem you may not use this file except in compliance with the License. 6 | @rem You may obtain a copy of the License at 7 | @rem 8 | @rem https://www.apache.org/licenses/LICENSE-2.0 9 | @rem 10 | @rem Unless required by applicable law or agreed to in writing, software 11 | @rem distributed under the License is distributed on an "AS IS" BASIS, 12 | @rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 | @rem See the License for the specific language governing permissions and 14 | @rem limitations under the License. 15 | @rem 16 | 17 | @if "%DEBUG%" == "" @echo off 18 | @rem ########################################################################## 19 | @rem 20 | @rem Gradle startup script for Windows 21 | @rem 22 | @rem ########################################################################## 23 | 24 | @rem Set local scope for the variables with windows NT shell 25 | if "%OS%"=="Windows_NT" setlocal 26 | 27 | set DIRNAME=%~dp0 28 | if "%DIRNAME%" == "" set DIRNAME=. 29 | set APP_BASE_NAME=%~n0 30 | set APP_HOME=%DIRNAME% 31 | 32 | @rem Resolve any "." and ".." in APP_HOME to make it shorter. 33 | for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi 34 | 35 | @rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. 36 | set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m" 37 | 38 | @rem Find java.exe 39 | if defined JAVA_HOME goto findJavaFromJavaHome 40 | 41 | set JAVA_EXE=java.exe 42 | %JAVA_EXE% -version >NUL 2>&1 43 | if "%ERRORLEVEL%" == "0" goto execute 44 | 45 | echo. 46 | echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 47 | echo. 48 | echo Please set the JAVA_HOME variable in your environment to match the 49 | echo location of your Java installation. 50 | 51 | goto fail 52 | 53 | :findJavaFromJavaHome 54 | set JAVA_HOME=%JAVA_HOME:"=% 55 | set JAVA_EXE=%JAVA_HOME%/bin/java.exe 56 | 57 | if exist "%JAVA_EXE%" goto execute 58 | 59 | echo. 60 | echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 61 | echo. 62 | echo Please set the JAVA_HOME variable in your environment to match the 63 | echo location of your Java installation. 64 | 65 | goto fail 66 | 67 | :execute 68 | @rem Setup the command line 69 | 70 | set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar 71 | 72 | 73 | @rem Execute Gradle 74 | "%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %* 75 | 76 | :end 77 | @rem End local scope for the variables with windows NT shell 78 | if "%ERRORLEVEL%"=="0" goto mainEnd 79 | 80 | :fail 81 | rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of 82 | rem the _cmd.exe /c_ return code! 83 | if not "" == "%GRADLE_EXIT_CONSOLE%" exit 1 84 | exit /b 1 85 | 86 | :mainEnd 87 | if "%OS%"=="Windows_NT" endlocal 88 | 89 | :omega 90 | -------------------------------------------------------------------------------- /PermissionManager/settings.gradle: -------------------------------------------------------------------------------- 1 | pluginManagement { 2 | repositories { 3 | gradlePluginPortal() 4 | google() 5 | mavenCentral() 6 | } 7 | plugins { 8 | id 'com.android.application' version '7.1.0-alpha11' 9 | id 'com.android.library' version '7.1.0-alpha11' 10 | } 11 | } 12 | dependencyResolutionManagement { 13 | repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS) 14 | repositories { 15 | google() 16 | mavenCentral() 17 | } 18 | } 19 | rootProject.name = "PermissionManager" 20 | include ':app' 21 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # SKRoot - SuperKernelRoot - Linux内核级完美隐藏ROOT演示 2 | 新一代SKRoot，挑战全网root检测手段，跟面具完全不同思路，摆脱面具被检测的弱点，完美隐藏root功能，实现真正的SELinux 0%触碰，通用性强，通杀所有内核，不需要内核源码，直接patch内核，兼容安卓APP直接JNI调用，稳定、流畅、不闪退。 3 | ## 功能列表： 4 | #### 1.测试ROOT权限 5 | #### 2.执行ROOT命令 6 | #### 3.以ROOT执行程序 7 | #### 4.安装部署su 8 | #### 5.注入su到指定进程 9 | #### 6.完全卸载清理su 10 | #### 7.寄生目标APP 11 | 12 | ## 效果： 13 | * **实验设备包括：红米K20\K30\K40\K50\K60、小米8\9\10\11\12\13、小米平板5\6、红魔5\6\7、联想、三星、一加、ROG2\3等，支持型号非常多。测试结果显示，SKRoot能够在所支持设备上非常稳定的运行。** 14 | * **过市面上所有主流APP的ROOT检测，如农业XX、交X12XX3等...** 15 | * **无需厂商提供源代码** 16 | * **愿世界迎来一个美好的ROOT时代！** 17 | 18 | ![image](https://github.com/abcz316/linuxKernelRoot/blob/master/ScreenCap/1.png) 19 | ![image](https://github.com/abcz316/linuxKernelRoot/blob/master/ScreenCap/3.png) 20 | ![image](https://github.com/abcz316/linuxKernelRoot/blob/master/ScreenCap/4.png) 21 | 22 | ## 功能备注： 23 | 1. APP应用程序得到ROOT权限的唯一方法就是得到ROOT密匙，此密匙为48位的随机字符串，安全可靠。 24 | 25 | 2. 其中【**注入su到指定进程**】**只支持授权su到64位的APP**，老式32位APP不再进行支持，因市面上几乎所有APP都是64位，例如MT文件管理器、Root Explorer文件管理器等等。 26 | 27 | ## 使用流程： 28 | 1.将内核文件拖拽置`patch_kernel_root.exe`即可一键自动化流程补丁内核，同时会自动生成ROOT密匙。 29 | 30 | 2.编译并启动`PermissionManager`或者`testRoot`，输入ROOT密匙值，开始享受舒爽的ROOT环境。 31 | 32 | ## 更新日志： 33 | 34 | 2025-5： 35 | * **1.修复Linux 6.1、6.6及以上无法解析问题** 36 | * **2.新增内核隐藏su路径（抵御安卓漏洞）** 37 | * **3.修复su进程不能退出有残留的问题** 38 | * **4.新增以ROOT身份直接执行程序功能** 39 | * **5.新增内核防冻结进程功能** 40 | 41 | 42 | 2024-9： 43 | * **1.新增永久授权su功能** 44 | 45 | 2023-8： 46 | * **1.新增seccomp补丁代码** 47 | * **2.新增寄生目标功能** 48 | * **3.新增一键自动化流程补丁内核功能** 49 | * **4.修复Linux 3.X老内核兼容问题** 50 | * **5.修复Linux 5.10、5.15无法开机问题** 51 | 52 | ## 问题排查： 53 | 1、如遇到Linux 6.0以上内核无法开机，请阅读： 54 | * **请不要使用Android.Image.Kitchen进行打包，该工具不支持Linux 6.0以上内核！** 55 | * **可使用magiskboot进行打包。** 56 | * **magiskboot的快速获取方式：使用7z解压Magisk apk，把lib文件夹里的libmagiskboot.so直接改名magiskboot即可使用。因为这是个可执行文件，并不是动态库，不要被名字带so字样所迷惑。** 57 | * **解包命令：./magiskboot unpack boot.img** 58 | * **打包命令：./magiskboot repack boot.img** 59 | 60 | 2、如发现第三方应用程序依然有侦测行为，请按照以下步骤进行排查： 61 | * **内核必须保证是基于官方原版进行修改，而非自行编译或使用第三方源码编译。** 62 | * **如果你曾经使用过Magisk，你应该先将手机完全刷机，因为Magisk可能会残留日志文件等信息。** 63 | * **不要安装需要ROOT权限的工具，或涉及系统环境检测的应用，如冰箱、黑洞、momo和密匙认证等。这些应用的存在可能会被用作证据，推断你的设备已获取ROOT权限。若需使用，请在使用后立即卸载。** 64 | * **Android APP可能会被特征检测。这里的APP只是演示功能写法。在实际使用中，请尽量隐藏APP。例如使用寄生功能，寄生到其他无害的APP内，以免被侦测。** 65 | * **如果在解锁BL后手机会发出警报，你需要自行解决这个问题，因为它与SKRoot无关。** 66 | * **如果对方是检测BL锁，而不是ROOT权限。你应该安装SKRoot的隐藏BL锁模块。** 67 | * **请检查SELinux状态是否被恶意软件禁用。** 68 | -------------------------------------------------------------------------------- /ScreenCap/1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/ScreenCap/1.png -------------------------------------------------------------------------------- /ScreenCap/3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/ScreenCap/3.png -------------------------------------------------------------------------------- /ScreenCap/4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/ScreenCap/4.png -------------------------------------------------------------------------------- /patch_kernel_root/3rdparty/capstone-4.0.2-win64/CREDITS.TXT: -------------------------------------------------------------------------------- 1 | This file credits all the contributors of the Capstone engine project. 2 | 3 | Key developers 4 | ============== 5 | 1. Nguyen Anh Quynh 6 | - Core engine 7 | - Bindings: Python, Ruby, OCaml, Java, C# 8 | 9 | 2. Tan Sheng Di 10 | - Bindings: Ruby 11 | 12 | 3. Ben Nagy 13 | - Bindings: Ruby, Go 14 | 15 | 4. Dang Hoang Vu 16 | - Bindings: Java 17 | 18 | 19 | Beta testers (in random order) 20 | ============================== 21 | Pancake 22 | Van Hauser 23 | FX of Phenoelit 24 | The Grugq, The Grugq <-- our hero for submitting the first ever patch! 25 | Isaac Dawson, Veracode Inc 26 | Patroklos Argyroudis, Census Inc. (http://census-labs.com) 27 | Attila Suszter 28 | Le Dinh Long 29 | Nicolas Ruff 30 | Gunther 31 | Alex Ionescu, Winsider Seminars & Solutions Inc. 32 | Snare 33 | Daniel Godas-Lopez 34 | Joshua J. Drake 35 | Edgar Barbosa 36 | Ralf-Philipp Weinmann 37 | Hugo Fortier 38 | Joxean Koret 39 | Bruce Dang 40 | Andrew Dunham 41 | 42 | 43 | Contributors (in no particular order) 44 | ===================================== 45 | (Please let us know if you want to have your name here) 46 | 47 | Ole André Vadla Ravnås (author of the 100th Pull-Request in our Github repo, thanks!) 48 | Axel "0vercl0k" Souchet (@0vercl0k) & Alex Ionescu: port to MSVC. 49 | Daniel Pistelli: Cmake support. 50 | Peter Hlavaty: integrate Capstone for Windows kernel drivers. 51 | Guillaume Jeanne: Ocaml binding. 52 | Martin Tofall, Obsidium Software: Optimize X86 performance & size + x86 encoding features. 53 | David Martínez Moreno & Hilko Bengen: Debian package. 54 | Félix Cloutier: Xcode project. 55 | Benoit Lecocq: OpenBSD package. 56 | Christophe Avoinne (Hlide): Improve memory management for better performance. 57 | Michael Cohen & Nguyen Tan Cong: Python module installer. 58 | Adel Gadllah, Francisco Alonso & Stefan Cornelius: RPM package. 59 | Felix Gröbert (Google): fuzz testing harness. 60 | Xipiter LLC: Capstone logo redesigned. 61 | Satoshi Tanda: Support Windows kernel driver. 62 | Tang Yuhang: cstool. 63 | Andrew Dutcher: better Python setup. 64 | Ruben Boonen: PowerShell binding. 65 | David Zimmer: VB6 binding. 66 | Philippe Antoine: Integration with oss-fuzz and various fixes. 67 | Bui Dinh Cuong: Explicit registers accessed for Arm64. 68 | Vincent Bénony: Explicit registers accessed for X86. 69 | Adel Gadllah, Francisco Alonso & Stefan Cornelius: RPM package. 70 | Felix Gröbert (Google): fuzz testing harness. 71 | Daniel Collin & Nicolas Planel: M68K architecture. 72 | Pranith Kumar: Explicit registers accessed for Arm64. 73 | Xipiter LLC: Capstone logo redesigned. 74 | Satoshi Tanda: Support Windows kernel driver. 75 | Koutheir Attouchi: Support for Windows CE. 76 | Fotis Loukos: TMS320C64x architecture. 77 | Wolfgang Schwotzer: M680X architecture. 78 | Philippe Antoine: Integration with oss-fuzz and various fixes. 79 | Stephen Eckels (stevemk14ebr): x86 encoding features 80 | -------------------------------------------------------------------------------- /patch_kernel_root/3rdparty/capstone-4.0.2-win64/LICENSE.TXT: -------------------------------------------------------------------------------- 1 | This is the software license for Capstone disassembly framework. 2 | Capstone has been designed & implemented by Nguyen Anh Quynh 3 | 4 | See http://www.capstone-engine.org for further information. 5 | 6 | Copyright (c) 2013, COSEINC. 7 | All rights reserved. 8 | 9 | Redistribution and use in source and binary forms, with or without 10 | modification, are permitted provided that the following conditions are met: 11 | 12 | * Redistributions of source code must retain the above copyright notice, 13 | this list of conditions and the following disclaimer. 14 | * Redistributions in binary form must reproduce the above copyright notice, 15 | this list of conditions and the following disclaimer in the documentation 16 | and/or other materials provided with the distribution. 17 | * Neither the name of the developer(s) nor the names of its 18 | contributors may be used to endorse or promote products derived from this 19 | software without specific prior written permission. 20 | 21 | THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 22 | AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 | IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 | ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE 25 | LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 26 | CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 27 | SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 28 | INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 29 | CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 30 | ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 31 | POSSIBILITY OF SUCH DAMAGE. 32 | -------------------------------------------------------------------------------- /patch_kernel_root/3rdparty/capstone-4.0.2-win64/LICENSE_LLVM.TXT: -------------------------------------------------------------------------------- 1 | ============================================================================== 2 | LLVM Release License 3 | ============================================================================== 4 | University of Illinois/NCSA 5 | Open Source License 6 | 7 | Copyright (c) 2003-2013 University of Illinois at Urbana-Champaign. 8 | All rights reserved. 9 | 10 | Developed by: 11 | 12 | LLVM Team 13 | 14 | University of Illinois at Urbana-Champaign 15 | 16 | http://llvm.org 17 | 18 | Permission is hereby granted, free of charge, to any person obtaining a copy of 19 | this software and associated documentation files (the "Software"), to deal with 20 | the Software without restriction, including without limitation the rights to 21 | use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies 22 | of the Software, and to permit persons to whom the Software is furnished to do 23 | so, subject to the following conditions: 24 | 25 | * Redistributions of source code must retain the above copyright notice, 26 | this list of conditions and the following disclaimers. 27 | 28 | * Redistributions in binary form must reproduce the above copyright notice, 29 | this list of conditions and the following disclaimers in the 30 | documentation and/or other materials provided with the distribution. 31 | 32 | * Neither the names of the LLVM Team, University of Illinois at 33 | Urbana-Champaign, nor the names of its contributors may be used to 34 | endorse or promote products derived from this Software without specific 35 | prior written permission. 36 | 37 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 38 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS 39 | FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 40 | CONTRIBUTORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 41 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 42 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS WITH THE 43 | SOFTWARE. 44 | 45 | ============================================================================== 46 | Copyrights and Licenses for Third Party Software Distributed with LLVM: 47 | ============================================================================== 48 | The LLVM software contains code written by third parties. Such software will 49 | have its own individual LICENSE.TXT file in the directory in which it appears. 50 | This file will describe the copyrights, license, and restrictions which apply 51 | to that code. 52 | 53 | The disclaimer of warranty in the University of Illinois Open Source License 54 | applies to all code in the LLVM Distribution, and nothing in any of the 55 | other licenses gives permission to use the names of the LLVM Team or the 56 | University of Illinois to endorse or promote products derived from this 57 | Software. 58 | 59 | The following pieces of software have additional or alternate copyrights, 60 | licenses, and/or restrictions: 61 | 62 | Program Directory 63 | ------- --------- 64 | Autoconf llvm/autoconf 65 | llvm/projects/ModuleMaker/autoconf 66 | llvm/projects/sample/autoconf 67 | Google Test llvm/utils/unittest/googletest 68 | OpenBSD regex llvm/lib/Support/{reg*, COPYRIGHT.regex} 69 | pyyaml tests llvm/test/YAMLParser/{*.data, LICENSE.TXT} 70 | ARM contributions llvm/lib/Target/ARM/LICENSE.TXT 71 | md5 contributions llvm/lib/Support/MD5.cpp llvm/include/llvm/Support/MD5.h 72 | -------------------------------------------------------------------------------- /patch_kernel_root/3rdparty/capstone-4.0.2-win64/README.md: -------------------------------------------------------------------------------- 1 | Capstone Engine 2 | =============== 3 | 4 | [![Build Status](https://travis-ci.org/aquynh/capstone.svg?branch=v4)](https://travis-ci.org/aquynh/capstone) 5 | [![Build status](https://ci.appveyor.com/api/projects/status/a4wvbn89wu3pinas/branch/v4?svg=true)](https://ci.appveyor.com/project/aquynh/capstone/branch/v4) 6 | 7 | Capstone is a disassembly framework with the target of becoming the ultimate 8 | disasm engine for binary analysis and reversing in the security community. 9 | 10 | Created by Nguyen Anh Quynh, then developed and maintained by a small community, 11 | Capstone offers some unparalleled features: 12 | 13 | - Support multiple hardware architectures: ARM, ARM64 (ARMv8), Ethereum VM, M68K, 14 | Mips, PPC, Sparc, SystemZ, TMS320C64X, M680X, XCore and X86 (including X86_64). 15 | 16 | - Having clean/simple/lightweight/intuitive architecture-neutral API. 17 | 18 | - Provide details on disassembled instruction (called “decomposer” by others). 19 | 20 | - Provide semantics of the disassembled instruction, such as list of implicit 21 | registers read & written. 22 | 23 | - Implemented in pure C language, with lightweight bindings for D, Clojure, F#, 24 | Common Lisp, Visual Basic, PHP, PowerShell, Emacs, Haskell, Perl, Python, 25 | Ruby, C#, NodeJS, Java, GO, C++, OCaml, Lua, Rust, Delphi, Free Pascal & Vala 26 | (ready either in main code, or provided externally by the community). 27 | 28 | - Native support for all popular platforms: Windows, Mac OSX, iOS, Android, 29 | Linux, \*BSD, Solaris, etc. 30 | 31 | - Thread-safe by design. 32 | 33 | - Special support for embedding into firmware or OS kernel. 34 | 35 | - High performance & suitable for malware analysis (capable of handling various 36 | X86 malware tricks). 37 | 38 | - Distributed under the open source BSD license. 39 | 40 | Further information is available at http://www.capstone-engine.org 41 | 42 | 43 | Compile 44 | ------- 45 | 46 | See COMPILE.TXT file for how to compile and install Capstone. 47 | 48 | 49 | Documentation 50 | ------------- 51 | 52 | See docs/README for how to customize & program your own tools with Capstone. 53 | 54 | 55 | Hack 56 | ---- 57 | 58 | See HACK.TXT file for the structure of the source code. 59 | 60 | 61 | License 62 | ------- 63 | 64 | This project is released under the BSD license. If you redistribute the binary 65 | or source code of Capstone, please attach file LICENSE.TXT with your products. 66 | -------------------------------------------------------------------------------- /patch_kernel_root/3rdparty/capstone-4.0.2-win64/RELEASE_NOTES: -------------------------------------------------------------------------------- 1 | This release 4.0.2 is dedicated to my dad! 2 | 3 | Without him, I would not work in computing field, let alone writing any code 4 | or making contribution to the cyber security community. 5 | -------------------------------------------------------------------------------- /patch_kernel_root/3rdparty/capstone-4.0.2-win64/SPONSORS.TXT: -------------------------------------------------------------------------------- 1 | * Version 4.0.2 - May 08th, 2020 2 | 3 | Release 4.0.2 was sponsored by the following companies (in no particular order). 4 | 5 | - Senrio: https://senr.io 6 | - Catena Cyber: https://catenacyber.fr 7 | 8 | ------------------------------------ 9 | 10 | * Version 4.0.1 - January 10th, 2019 11 | 12 | Release 4.0.1 was sponsored by the following companies (in no particular order). 13 | 14 | - NowSecure: https://www.nowsecure.com 15 | - Verichains: https://verichains.io 16 | - Vsec: https://vsec.com.vn 17 | 18 | ----------------------------------- 19 | * Version 4.0 - December 18th, 2018 20 | 21 | Capstone 4.0 version marks 5 years of the project! 22 | This release was sponsored by the following companies (in no particular order). 23 | 24 | - Thinkst Canary: https://canary.tools 25 | - NowSecure: https://www.nowsecure.com 26 | - ECQ: https://e-cq.net 27 | - Senrio: https://senr.io 28 | - GracefulBits: https://gracefulbits.com 29 | - Catena Cyber: https://catenacyber.fr 30 | -------------------------------------------------------------------------------- /patch_kernel_root/3rdparty/capstone-4.0.2-win64/capstone.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/patch_kernel_root/3rdparty/capstone-4.0.2-win64/capstone.dll -------------------------------------------------------------------------------- /patch_kernel_root/3rdparty/capstone-4.0.2-win64/capstone.lib: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/patch_kernel_root/3rdparty/capstone-4.0.2-win64/capstone.lib -------------------------------------------------------------------------------- /patch_kernel_root/3rdparty/capstone-4.0.2-win64/capstone_dll.lib: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/patch_kernel_root/3rdparty/capstone-4.0.2-win64/capstone_dll.lib -------------------------------------------------------------------------------- /patch_kernel_root/3rdparty/capstone-4.0.2-win64/cstool.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/patch_kernel_root/3rdparty/capstone-4.0.2-win64/cstool.exe -------------------------------------------------------------------------------- /patch_kernel_root/3rdparty/capstone-4.0.2-win64/include/platform.h: -------------------------------------------------------------------------------- 1 | /* Capstone Disassembly Engine */ 2 | /* By Axel Souchet & Nguyen Anh Quynh, 2014 */ 3 | 4 | #ifndef CAPSTONE_PLATFORM_H 5 | #define CAPSTONE_PLATFORM_H 6 | 7 | // handle C99 issue (for pre-2013 VisualStudio) 8 | #if !defined(__CYGWIN__) && !defined(__MINGW32__) && !defined(__MINGW64__) && (defined (WIN32) || defined (WIN64) || defined (_WIN32) || defined (_WIN64)) 9 | // MSVC 10 | 11 | // stdbool.h 12 | #if (_MSC_VER < 1800) || defined(_KERNEL_MODE) 13 | // this system does not have stdbool.h 14 | #ifndef __cplusplus 15 | typedef unsigned char bool; 16 | #define false 0 17 | #define true 1 18 | #endif 19 | 20 | #else 21 | // VisualStudio 2013+ -> C99 is supported 22 | #include 23 | #endif 24 | 25 | #else 26 | // not MSVC -> C99 is supported 27 | #include 28 | #endif 29 | 30 | 31 | // handle C99 issue (for pre-2013 VisualStudio) 32 | #if defined(CAPSTONE_HAS_OSXKERNEL) || (defined(_MSC_VER) && (_MSC_VER <= 1700 || defined(_KERNEL_MODE))) 33 | // this system does not have inttypes.h 34 | 35 | #if defined(_MSC_VER) && (_MSC_VER < 1600 || defined(_KERNEL_MODE)) 36 | // this system does not have stdint.h 37 | typedef signed char int8_t; 38 | typedef signed short int16_t; 39 | typedef signed int int32_t; 40 | typedef unsigned char uint8_t; 41 | typedef unsigned short uint16_t; 42 | typedef unsigned int uint32_t; 43 | typedef signed long long int64_t; 44 | typedef unsigned long long uint64_t; 45 | 46 | #define INT8_MIN (-127i8 - 1) 47 | #define INT16_MIN (-32767i16 - 1) 48 | #define INT32_MIN (-2147483647i32 - 1) 49 | #define INT64_MIN (-9223372036854775807i64 - 1) 50 | #define INT8_MAX 127i8 51 | #define INT16_MAX 32767i16 52 | #define INT32_MAX 2147483647i32 53 | #define INT64_MAX 9223372036854775807i64 54 | #define UINT8_MAX 0xffui8 55 | #define UINT16_MAX 0xffffui16 56 | #define UINT32_MAX 0xffffffffui32 57 | #define UINT64_MAX 0xffffffffffffffffui64 58 | #endif 59 | 60 | #define __PRI_8_LENGTH_MODIFIER__ "hh" 61 | #define __PRI_64_LENGTH_MODIFIER__ "ll" 62 | 63 | #define PRId8 __PRI_8_LENGTH_MODIFIER__ "d" 64 | #define PRIi8 __PRI_8_LENGTH_MODIFIER__ "i" 65 | #define PRIo8 __PRI_8_LENGTH_MODIFIER__ "o" 66 | #define PRIu8 __PRI_8_LENGTH_MODIFIER__ "u" 67 | #define PRIx8 __PRI_8_LENGTH_MODIFIER__ "x" 68 | #define PRIX8 __PRI_8_LENGTH_MODIFIER__ "X" 69 | 70 | #define PRId16 "hd" 71 | #define PRIi16 "hi" 72 | #define PRIo16 "ho" 73 | #define PRIu16 "hu" 74 | #define PRIx16 "hx" 75 | #define PRIX16 "hX" 76 | 77 | #if defined(_MSC_VER) && _MSC_VER <= 1700 78 | #define PRId32 "ld" 79 | #define PRIi32 "li" 80 | #define PRIo32 "lo" 81 | #define PRIu32 "lu" 82 | #define PRIx32 "lx" 83 | #define PRIX32 "lX" 84 | #else // OSX 85 | #define PRId32 "d" 86 | #define PRIi32 "i" 87 | #define PRIo32 "o" 88 | #define PRIu32 "u" 89 | #define PRIx32 "x" 90 | #define PRIX32 "X" 91 | #endif 92 | 93 | #if defined(_MSC_VER) && _MSC_VER <= 1700 94 | // redefine functions from inttypes.h used in cstool 95 | #define strtoull _strtoui64 96 | #endif 97 | 98 | #define PRId64 __PRI_64_LENGTH_MODIFIER__ "d" 99 | #define PRIi64 __PRI_64_LENGTH_MODIFIER__ "i" 100 | #define PRIo64 __PRI_64_LENGTH_MODIFIER__ "o" 101 | #define PRIu64 __PRI_64_LENGTH_MODIFIER__ "u" 102 | #define PRIx64 __PRI_64_LENGTH_MODIFIER__ "x" 103 | #define PRIX64 __PRI_64_LENGTH_MODIFIER__ "X" 104 | 105 | #else 106 | // this system has inttypes.h by default 107 | #include 108 | #endif 109 | 110 | #endif 111 | -------------------------------------------------------------------------------- /patch_kernel_root/3rdparty/capstone-4.0.2-win64/include/windowsce/intrin.h: -------------------------------------------------------------------------------- 1 | 2 | #if defined(_MSC_VER) && defined(_WIN32_WCE) && (_WIN32_WCE < 0x800) && !defined(__INTRIN_H_) && !defined(_INTRIN) 3 | #define _STDINT 4 | 5 | #ifdef _M_ARM 6 | #include 7 | #if (_WIN32_WCE >= 0x700) && defined(__ARM_ARCH_7__) || defined(__ARM_ARCH_7A__) 8 | #include 9 | #endif 10 | #endif // _M_ARM 11 | 12 | #endif 13 | -------------------------------------------------------------------------------- /patch_kernel_root/3rdparty/capstone-4.0.2-win64/include/windowsce/stdint.h: -------------------------------------------------------------------------------- 1 | 2 | #if defined(_MSC_VER) && defined(_WIN32_WCE) && (_WIN32_WCE < 0x800) && !defined(_STDINT_H_) && !defined(_STDINT) 3 | #define _STDINT 4 | 5 | typedef __int8 6 | int8_t, 7 | int_least8_t; 8 | 9 | typedef __int16 10 | int16_t, 11 | int_least16_t; 12 | 13 | typedef __int32 14 | int32_t, 15 | int_least32_t, 16 | int_fast8_t, 17 | int_fast16_t, 18 | int_fast32_t; 19 | 20 | typedef __int64 21 | int64_t, 22 | intmax_t, 23 | int_least64_t, 24 | int_fast64_t; 25 | 26 | typedef unsigned __int8 27 | uint8_t, 28 | uint_least8_t; 29 | 30 | typedef unsigned __int16 31 | uint16_t, 32 | uint_least16_t; 33 | 34 | typedef unsigned __int32 35 | uint32_t, 36 | uint_least32_t, 37 | uint_fast8_t, 38 | uint_fast16_t, 39 | uint_fast32_t; 40 | 41 | typedef unsigned __int64 42 | uint64_t, 43 | uintmax_t, 44 | uint_least64_t, 45 | uint_fast64_t; 46 | 47 | #ifndef _INTPTR_T_DEFINED 48 | #define _INTPTR_T_DEFINED 49 | typedef __int32 intptr_t; 50 | #endif 51 | 52 | #ifndef _UINTPTR_T_DEFINED 53 | #define _UINTPTR_T_DEFINED 54 | typedef unsigned __int32 uintptr_t; 55 | #endif 56 | 57 | #define INT8_MIN (-127i8 - 1) 58 | #define INT16_MIN (-32767i16 - 1) 59 | #define INT32_MIN (-2147483647i32 - 1) 60 | #define INT64_MIN (-9223372036854775807i64 - 1) 61 | #define INT8_MAX 127i8 62 | #define INT16_MAX 32767i16 63 | #define INT32_MAX 2147483647i32 64 | #define INT64_MAX 9223372036854775807i64 65 | #define UINT8_MAX 0xffui8 66 | #define UINT16_MAX 0xffffui16 67 | #define UINT32_MAX 0xffffffffui32 68 | #define UINT64_MAX 0xffffffffffffffffui64 69 | 70 | #define INT_LEAST8_MIN INT8_MIN 71 | #define INT_LEAST16_MIN INT16_MIN 72 | #define INT_LEAST32_MIN INT32_MIN 73 | #define INT_LEAST64_MIN INT64_MIN 74 | #define INT_LEAST8_MAX INT8_MAX 75 | #define INT_LEAST16_MAX INT16_MAX 76 | #define INT_LEAST32_MAX INT32_MAX 77 | #define INT_LEAST64_MAX INT64_MAX 78 | #define UINT_LEAST8_MAX UINT8_MAX 79 | #define UINT_LEAST16_MAX UINT16_MAX 80 | #define UINT_LEAST32_MAX UINT32_MAX 81 | #define UINT_LEAST64_MAX UINT64_MAX 82 | 83 | #define INT_FAST8_MIN INT8_MIN 84 | #define INT_FAST16_MIN INT32_MIN 85 | #define INT_FAST32_MIN INT32_MIN 86 | #define INT_FAST64_MIN INT64_MIN 87 | #define INT_FAST8_MAX INT8_MAX 88 | #define INT_FAST16_MAX INT32_MAX 89 | #define INT_FAST32_MAX INT32_MAX 90 | #define INT_FAST64_MAX INT64_MAX 91 | #define UINT_FAST8_MAX UINT8_MAX 92 | #define UINT_FAST16_MAX UINT32_MAX 93 | #define UINT_FAST32_MAX UINT32_MAX 94 | #define UINT_FAST64_MAX UINT64_MAX 95 | 96 | #define INTPTR_MIN INT32_MIN 97 | #define INTPTR_MAX INT32_MAX 98 | #define UINTPTR_MAX UINT32_MAX 99 | 100 | #define INTMAX_MIN INT64_MIN 101 | #define INTMAX_MAX INT64_MAX 102 | #define UINTMAX_MAX UINT64_MAX 103 | 104 | #define PTRDIFF_MIN INTPTR_MIN 105 | #define PTRDIFF_MAX INTPTR_MAX 106 | 107 | #ifndef SIZE_MAX 108 | #define SIZE_MAX UINTPTR_MAX 109 | #endif 110 | 111 | #define SIG_ATOMIC_MIN INT32_MIN 112 | #define SIG_ATOMIC_MAX INT32_MAX 113 | 114 | #define WCHAR_MIN 0x0000 115 | #define WCHAR_MAX 0xffff 116 | 117 | #define WINT_MIN 0x0000 118 | #define WINT_MAX 0xffff 119 | 120 | #define INT8_C(x) (x) 121 | #define INT16_C(x) (x) 122 | #define INT32_C(x) (x) 123 | #define INT64_C(x) (x ## LL) 124 | 125 | #define UINT8_C(x) (x) 126 | #define UINT16_C(x) (x) 127 | #define UINT32_C(x) (x ## U) 128 | #define UINT64_C(x) (x ## ULL) 129 | 130 | #define INTMAX_C(x) INT64_C(x) 131 | #define UINTMAX_C(x) UINT64_C(x) 132 | 133 | #endif 134 | -------------------------------------------------------------------------------- /patch_kernel_root/analyze/ARM_asm.h: -------------------------------------------------------------------------------- 1 | #ifndef ARM_ASM_HELPER_H_ 2 | #define ARM_ASM_HELPER_H_ 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include "base_func.h" 9 | 10 | static std::string AsmToBytes(const std::string& strArm64Asm) { 11 | //获取汇编文本 12 | 13 | //获取自身运行目录 14 | char szFileName[MAX_PATH] = { 0 }; 15 | ::GetModuleFileNameA(NULL, szFileName, MAX_PATH); 16 | std::string strMyPath = szFileName; 17 | strMyPath = strMyPath.substr(0, strMyPath.find_last_of('\\') + 1); 18 | 19 | std::string asmFilePath = strMyPath + "aarch64-linux-android-as.exe"; 20 | if (!std::filesystem::exists(asmFilePath)) { 21 | std::cerr << "Error: aarch64-linux-android-as.exe not found. Please extract this file from the Android NDK." << std::endl; 22 | exit(EXIT_FAILURE); 23 | } 24 | 25 | //写出input.txt 26 | std::ofstream inputFile; 27 | inputFile.open(strMyPath + "input.txt", std::ios_base::out | std::ios_base::trunc); 28 | inputFile << strArm64Asm; 29 | inputFile.close(); 30 | 31 | //ARM64 32 | DeleteFileA(std::string(strMyPath + "output.txt").c_str()); 33 | 34 | std::string cmd = strMyPath + "aarch64-linux-android-as.exe -ahlm " + strMyPath + "input.txt >> " + strMyPath + "output.txt"; 35 | system(cmd.c_str()); 36 | 37 | //未开发的 38 | //ARM：arm-linux-as.exe -ahlm -k -mthumb-interwork -march=armv7-a %s >> %s 39 | //Thumb：arm-linux-as.exe -ahlm -k -mthumb-interwork -march=armv7 %s >> %s 40 | 41 | //读取output.txt 42 | std::ifstream in(strMyPath + "output.txt"); 43 | std::stringstream ssOutput; 44 | std::string line; 45 | bool bIsFirstLine = true; 46 | if (in) // 有该文件 47 | { 48 | while (getline(in, line)) // line中不包括每行的换行符 49 | { 50 | if (bIsFirstLine) { 51 | bIsFirstLine = false; 52 | continue; 53 | } 54 | if (!line.length()) { continue; } 55 | if (line.length() == 1 && line == "\n") { continue; } 56 | if (line.find("Error") != -1) { 57 | in.close(); 58 | return {}; 59 | } 60 | if (line.find("AARCH64 GAS") != -1) { continue; } 61 | 62 | std::stringstream ssGetMidBuf; 63 | std::string word; 64 | ssGetMidBuf << line; 65 | int n = 0; 66 | while (ssGetMidBuf >> word) { 67 | n++; 68 | if (n == 3) { 69 | ssOutput << word; 70 | } 71 | word.clear(); 72 | } 73 | 74 | 75 | } 76 | in.close(); 77 | } 78 | 79 | return ssOutput.str(); 80 | 81 | } 82 | 83 | static std::string AsmLabelToOffset(const std::string& asm_code, const char* end_label_name, const char* jump_label_name) { 84 | // 得到结尾位置 85 | std::string s = asm_code; 86 | size_t n = s.find(end_label_name); 87 | if (n == -1) { 88 | return s; 89 | } 90 | std::string before = s.substr(0, n); 91 | size_t end_back_idx_line = count_endl(before); 92 | replace_all_distinct(s, end_label_name, ""); 93 | 94 | // 逐行切割 95 | std::vector lines; 96 | { 97 | std::istringstream iss(s); 98 | std::string line; 99 | while (std::getline(iss, line)) { 100 | if (!line.empty() && line.back() == '\r') 101 | line.pop_back(); 102 | lines.push_back(line); 103 | } 104 | } 105 | 106 | // 替换每一行中的 #JUMP_END 107 | const std::string placeholder = jump_label_name; 108 | for (size_t idx = 0; idx < lines.size(); ++idx) { 109 | auto p = lines[idx].find(placeholder); 110 | if (p != std::string::npos) { 111 | int imm = (end_back_idx_line - idx) * 4; 112 | lines[idx].replace(p, placeholder.size(), std::to_string(imm)); 113 | } 114 | } 115 | 116 | // 拼回去 117 | std::string out; 118 | for (size_t i = 0; i < lines.size(); ++i) { 119 | out += lines[i]; 120 | out += "\n"; 121 | } 122 | return out; 123 | } 124 | 125 | #endif /* ARM_ASM_HELPER_H_ */ 126 | -------------------------------------------------------------------------------- /patch_kernel_root/analyze/base_func.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | 10 | static const char HEX[16] = { 11 | '0', '1', '2', '3', 12 | '4', '5', '6', '7', 13 | '8', '9', 'a', 'b', 14 | 'c', 'd', 'e', 'f' 15 | }; 16 | 17 | static std::vector read_file_buf(const std::string& file_path) { 18 | std::ifstream file(file_path, std::ios::binary | std::ios::ate); 19 | if (file) { 20 | auto size = file.tellg(); 21 | std::vector buffer(size); 22 | file.seekg(0, std::ios::beg); 23 | file.read(buffer.data(), size); 24 | file.close(); 25 | return buffer; 26 | } 27 | return {}; 28 | } 29 | 30 | static void get_rand_str(char* dest, int n) { 31 | int i, randno; 32 | char stardstring[63] = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"; 33 | srand((unsigned)time(NULL)); 34 | for (i = 0; i < n; i++) { 35 | randno = rand() % 62; 36 | *dest = stardstring[randno]; 37 | dest++; 38 | } 39 | } 40 | 41 | static std::string generate_random_root_key() { 42 | const int key_len = 48; 43 | char root_key_data[key_len] = { 0 }; 44 | get_rand_str(root_key_data, sizeof(root_key_data)); 45 | std::string str_root_key(root_key_data, sizeof(root_key_data)); 46 | return str_root_key; 47 | } 48 | 49 | static auto hex2bytes(uint8_t* hex, uint8_t* str) -> void { 50 | char high, low; 51 | for (size_t i = 0, length = strlen((char*)hex); i < length; i += 2) { 52 | high = toupper(hex[i]) - '0'; 53 | low = toupper(hex[i + 1]) - '0'; 54 | str[i / 2] = ((high > 9 ? high - 7 : high) << 4) + (low > 9 ? low - 7 : low); 55 | } 56 | } 57 | static std::string bytes2hex(const unsigned char* input, size_t length) { 58 | 59 | std::string str; 60 | str.reserve(length << 1); 61 | for (size_t i = 0; i < length; ++i) { 62 | int t = input[i]; 63 | int a = t / 16; 64 | int b = t % 16; 65 | str.append(1, HEX[a]); 66 | str.append(1, HEX[b]); 67 | } 68 | return str; 69 | } 70 | 71 | static bool write_file_bytes(const char* file_path, size_t offset, const char* bytes, size_t len) { 72 | std::fstream file_stream(file_path, std::ios::in | std::ios::out | std::ios::binary); 73 | if (!file_stream) { 74 | return false; 75 | } 76 | file_stream.seekp(offset); 77 | if (!file_stream.good()) { 78 | file_stream.close(); 79 | return false; 80 | } 81 | file_stream.write(bytes, len); 82 | if (!file_stream.good()) { 83 | file_stream.close(); 84 | return false; 85 | } 86 | file_stream.close(); 87 | return true; 88 | } 89 | 90 | static size_t align8(size_t addr) { 91 | if (addr % 8 != 0) { 92 | addr = (addr + 7) & ~static_cast(7); // Align to next 8-byte boundary 93 | } 94 | return addr; 95 | } 96 | 97 | static size_t count_endl(const std::string& s) { 98 | return std::count(s.begin(), s.end(), '\n'); 99 | } 100 | 101 | static void replace_all_distinct(std::string& str, const std::string& old_value, const std::string& new_value) { 102 | for (std::string::size_type pos(0); pos != std::string::npos; pos += new_value.length()) { 103 | if ((pos = str.find(old_value, pos)) != std::string::npos) { 104 | str.replace(pos, old_value.length(), new_value); 105 | } 106 | else { 107 | break; 108 | } 109 | } 110 | } 111 | -------------------------------------------------------------------------------- /patch_kernel_root/analyze/kallsyms_lookup_name.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | #include 4 | class KallsymsLookupName 5 | { 6 | public: 7 | KallsymsLookupName(const std::vector& file_buf); 8 | ~KallsymsLookupName(); 9 | 10 | public: 11 | bool init(); 12 | bool is_inited(); 13 | uint64_t kallsyms_lookup_name(const char* name, bool include_str_mode = false); 14 | int get_kallsyms_num(); 15 | 16 | private: 17 | bool find_kallsyms_addresses_list(size_t& start, size_t& end); 18 | int find_kallsyms_num(size_t addresses_list_start, size_t addresses_list_end, size_t& kallsyms_num_offset); 19 | bool find_kallsyms_names_list(int kallsyms_num, size_t kallsyms_num_end_offset, size_t& name_list_start, size_t& name_list_end); 20 | bool find_kallsyms_markers_list(int kallsyms_num, size_t name_list_end_offset, size_t& markers_list_start, size_t& markers_list_end); 21 | bool find_kallsyms_token_table(size_t markers_list_end_offset, size_t& kallsyms_token_table_start, size_t& kallsyms_token_table_end); 22 | bool find_kallsyms_token_index(size_t kallsyms_token_table_end, size_t& kallsyms_token_index_start); 23 | bool find_kallsyms_sym_func_entry_offset(size_t& kallsyms_sym_func_entry_offset); 24 | 25 | unsigned int kallsyms_expand_symbol(unsigned int off, char* result, size_t maxlen); 26 | uint64_t __kallsyms_lookup_name(const char* name, bool include_str_mode = false); 27 | 28 | const std::vector& m_file_buf; 29 | int m_kallsyms_num = 0; 30 | bool m_inited = false; 31 | size_t m_kallsyms_sym_func_entry_offset = 0; 32 | size_t m_text_offset = 0; 33 | struct kallsyms_addresses_info { 34 | size_t offset = 0; 35 | void printf() { 36 | std::cout << std::hex << "kallsyms_addressess offset: 0x" << offset << std::endl; 37 | } 38 | } m_kallsyms_addresses; 39 | 40 | struct kallsyms_names_info { 41 | size_t offset = 0; 42 | void printf() { 43 | std::cout << std::hex << "kallsyms_names offset: 0x" << offset << std::endl; 44 | } 45 | } m_kallsyms_names; 46 | 47 | struct kallsyms_markers_info { 48 | size_t offset = 0; 49 | void printf() { 50 | std::cout << std::hex << "kallsyms_markers offset: 0x" << offset << std::endl; 51 | } 52 | } m_kallsyms_markers; 53 | 54 | struct kallsyms_token_table_info { 55 | size_t offset = 0; 56 | void printf() { 57 | std::cout << std::hex << "kallsyms_token_table offset: 0x" << offset << std::endl; 58 | } 59 | } m_kallsyms_token_table; 60 | 61 | struct kallsyms_token_index_info { 62 | size_t offset = 0; 63 | void printf() { 64 | std::cout << std::hex << "kallsyms_token_index offset: 0x" << offset << std::endl; 65 | } 66 | } m_kallsyms_token_index; 67 | }; -------------------------------------------------------------------------------- /patch_kernel_root/analyze/kallsyms_lookup_name_4_6_0.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | #include 4 | class KallsymsLookupName_4_6_0 5 | { 6 | public: 7 | KallsymsLookupName_4_6_0(const std::vector& file_buf); 8 | ~KallsymsLookupName_4_6_0(); 9 | 10 | public: 11 | bool init(); 12 | bool is_inited(); 13 | uint64_t kallsyms_lookup_name(const char* name, bool include_str_mode = false); 14 | int get_kallsyms_num(); 15 | 16 | private: 17 | bool find_kallsyms_offsets_list(size_t& start, size_t& end); 18 | int find_kallsyms_num(size_t offset_list_start, size_t offset_list_end, size_t& kallsyms_num_offset); 19 | bool find_kallsyms_names_list(int kallsyms_num, size_t kallsyms_num_end_offset, size_t& name_list_start, size_t& name_list_end); 20 | bool find_kallsyms_markers_list(int kallsyms_num, size_t name_list_end_offset, size_t& markers_list_start, size_t& markers_list_end); 21 | bool find_kallsyms_token_table(size_t markers_list_end_offset, size_t& kallsyms_token_table_start, size_t& kallsyms_token_table_end); 22 | bool find_kallsyms_token_index(size_t kallsyms_token_table_end, size_t& kallsyms_token_index_start); 23 | bool find_kallsyms_sym_func_entry_offset(size_t& kallsyms_sym_func_entry_offset); 24 | 25 | unsigned int kallsyms_expand_symbol(unsigned int off, char* result, size_t maxlen); 26 | uint64_t __kallsyms_lookup_name(const char* name, bool include_str_mode = false); 27 | 28 | const std::vector& m_file_buf; 29 | int m_kallsyms_num = 0; 30 | bool m_inited = false; 31 | size_t m_kallsyms_sym_func_entry_offset = 0; 32 | 33 | struct kallsyms_offsets_info { 34 | size_t offset = 0; 35 | void printf() { 36 | std::cout << std::hex << "kallsyms_offsets offset: 0x" << offset << std::endl; 37 | } 38 | } m_kallsyms_offsets; 39 | 40 | struct kallsyms_names_info { 41 | size_t offset = 0; 42 | void printf() { 43 | std::cout << std::hex << "kallsyms_names offset: 0x" << offset << std::endl; 44 | } 45 | } m_kallsyms_names; 46 | 47 | struct kallsyms_markers_info { 48 | size_t offset = 0; 49 | void printf() { 50 | std::cout << std::hex << "kallsyms_markers offset: 0x" << offset << std::endl; 51 | } 52 | } m_kallsyms_markers; 53 | 54 | struct kallsyms_token_table_info { 55 | size_t offset = 0; 56 | void printf() { 57 | std::cout << std::hex << "kallsyms_token_table offset: 0x" << offset << std::endl; 58 | } 59 | } m_kallsyms_token_table; 60 | 61 | struct kallsyms_token_index_info { 62 | size_t offset = 0; 63 | void printf() { 64 | std::cout << std::hex << "kallsyms_token_index offset: 0x" << offset << std::endl; 65 | } 66 | } m_kallsyms_token_index; 67 | }; -------------------------------------------------------------------------------- /patch_kernel_root/analyze/kallsyms_lookup_name_6_1_42.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | #include 4 | class KallsymsLookupName_6_1_42 5 | { 6 | public: 7 | KallsymsLookupName_6_1_42(const std::vector& file_buf); 8 | ~KallsymsLookupName_6_1_42(); 9 | 10 | public: 11 | bool init(); 12 | bool is_inited(); 13 | uint64_t kallsyms_lookup_name(const char* name, bool include_str_mode = false); 14 | int get_kallsyms_num(); 15 | 16 | private: 17 | bool find_kallsyms_offsets_list(size_t& start, size_t& end); 18 | uint64_t find_kallsyms_relative_base(size_t offset_list_end, size_t& kallsyms_relative_base_offset); 19 | int find_kallsyms_num(size_t offset_list_start, size_t offset_list_end, size_t kallsyms_relative_base_end_offset, size_t& kallsyms_num_offset); 20 | bool find_kallsyms_names_list(int kallsyms_num, size_t kallsyms_num_end_offset, size_t& name_list_start, size_t& name_list_end); 21 | bool find_kallsyms_markers_list(int kallsyms_num, size_t name_list_end_offset, size_t& markers_list_start, size_t& markers_list_end, bool & markers_list_is_align8); 22 | bool find_kallsyms_seqs_of_names_list(int kallsyms_num, size_t markers_list_end_offset, bool markers_list_is_align8, size_t& seqs_of_names_list_start, size_t& seqs_of_names_list_end); 23 | bool find_kallsyms_token_table(size_t seqs_of_names_list_end_offset, size_t& kallsyms_token_table_start, size_t& kallsyms_token_table_end); 24 | bool find_kallsyms_token_index(size_t kallsyms_token_table_end, size_t& kallsyms_token_index_start); 25 | bool find_kallsyms_sym_func_entry_offset(size_t& kallsyms_sym_func_entry_offset); 26 | 27 | unsigned int kallsyms_expand_symbol(unsigned int off, char* result, size_t maxlen); 28 | uint64_t __kallsyms_lookup_name(const char* name, bool include_str_mode = false); 29 | int kallsyms_lookup_names(const char* name, unsigned int* start, unsigned int* end); 30 | unsigned int get_symbol_offset(unsigned long pos); 31 | uint64_t kallsyms_sym_address(int idx); 32 | int compare_symbol_name(const char* name, char* namebuf); 33 | bool cleanup_symbol_name(char* s); 34 | 35 | const std::vector& m_file_buf; 36 | uint64_t m_kallsyms_relative_base = 0; 37 | int m_kallsyms_num = 0; 38 | bool m_inited = false; 39 | size_t m_kallsyms_sym_func_entry_offset = 0; 40 | 41 | struct kallsyms_offsets_info { 42 | size_t offset = 0; 43 | void printf() { 44 | std::cout << std::hex << "kallsyms_offsets offset: 0x" << offset << std::endl; 45 | } 46 | } m_kallsyms_offsets; 47 | 48 | struct kallsyms_names_info { 49 | size_t offset = 0; 50 | void printf() { 51 | std::cout << std::hex << "kallsyms_names offset: 0x" << offset << std::endl; 52 | } 53 | } m_kallsyms_names; 54 | 55 | struct kallsyms_markers_info { 56 | size_t offset = 0; 57 | void printf() { 58 | std::cout << std::hex << "kallsyms_markers offset: 0x" << offset << std::endl; 59 | } 60 | } m_kallsyms_markers; 61 | 62 | struct kallsyms_seqs_of_names_info { 63 | size_t offset = 0; 64 | void printf() { 65 | std::cout << std::hex << "kallsyms_seqs_of_names offset: 0x" << offset << std::endl; 66 | } 67 | } m_kallsyms_seqs_of_names; 68 | 69 | struct kallsyms_token_table_info { 70 | size_t offset = 0; 71 | void printf() { 72 | std::cout << std::hex << "kallsyms_token_table offset: 0x" << offset << std::endl; 73 | } 74 | } m_kallsyms_token_table; 75 | 76 | struct kallsyms_token_index_info { 77 | size_t offset = 0; 78 | void printf() { 79 | std::cout << std::hex << "kallsyms_token_index offset: 0x" << offset << std::endl; 80 | } 81 | } m_kallsyms_token_index; 82 | }; -------------------------------------------------------------------------------- /patch_kernel_root/analyze/kallsyms_lookup_name_6_1_60.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | #include 4 | class KallsymsLookupName_6_1_60 5 | { 6 | public: 7 | KallsymsLookupName_6_1_60(const std::vector& file_buf); 8 | ~KallsymsLookupName_6_1_60(); 9 | 10 | public: 11 | bool init(); 12 | bool is_inited(); 13 | uint64_t kallsyms_lookup_name(const char* name, bool include_str_mode = false); 14 | int get_kallsyms_num(); 15 | 16 | private: 17 | bool find_kallsyms_offsets_list(size_t& start, size_t& end); 18 | uint64_t find_kallsyms_relative_base(size_t offset_list_end, size_t& kallsyms_relative_base_offset); 19 | int find_kallsyms_num(size_t offset_list_start, size_t offset_list_end, size_t kallsyms_relative_base_end_offset, size_t& kallsyms_num_offset); 20 | bool find_kallsyms_names_list(int kallsyms_num, size_t kallsyms_num_end_offset, size_t& name_list_start, size_t& name_list_end); 21 | bool find_kallsyms_markers_list(int kallsyms_num, size_t name_list_end_offset, size_t& markers_list_start, size_t& markers_list_end, bool & markers_list_is_align8); 22 | bool find_kallsyms_seqs_of_names_list(int kallsyms_num, size_t markers_list_end_offset, bool markers_list_is_align8, size_t& seqs_of_names_list_start, size_t& seqs_of_names_list_end); 23 | bool find_kallsyms_token_table(size_t seqs_of_names_list_end_offset, size_t& kallsyms_token_table_start, size_t& kallsyms_token_table_end); 24 | bool find_kallsyms_token_index(size_t kallsyms_token_table_end, size_t& kallsyms_token_index_start); 25 | bool find_kallsyms_sym_func_entry_offset(size_t& kallsyms_sym_func_entry_offset); 26 | 27 | unsigned int kallsyms_expand_symbol(unsigned int off, char* result, size_t maxlen); 28 | uint64_t __kallsyms_lookup_name(const char* name, bool include_str_mode = false); 29 | int kallsyms_lookup_names(const char* name, unsigned int* start, unsigned int* end); 30 | unsigned int get_symbol_seq(int index); 31 | unsigned int get_symbol_offset(unsigned long pos); 32 | uint64_t kallsyms_sym_address(int idx); 33 | int compare_symbol_name(const char* name, char* namebuf); 34 | bool cleanup_symbol_name(char* s); 35 | 36 | const std::vector& m_file_buf; 37 | uint64_t m_kallsyms_relative_base = 0; 38 | int m_kallsyms_num = 0; 39 | bool m_inited = false; 40 | size_t m_kallsyms_sym_func_entry_offset = 0; 41 | 42 | struct kallsyms_offsets_info { 43 | size_t offset = 0; 44 | void printf() { 45 | std::cout << std::hex << "kallsyms_offsets offset: 0x" << offset << std::endl; 46 | } 47 | } m_kallsyms_offsets; 48 | 49 | struct kallsyms_names_info { 50 | size_t offset = 0; 51 | void printf() { 52 | std::cout << std::hex << "kallsyms_names offset: 0x" << offset << std::endl; 53 | } 54 | } m_kallsyms_names; 55 | 56 | struct kallsyms_markers_info { 57 | size_t offset = 0; 58 | void printf() { 59 | std::cout << std::hex << "kallsyms_markers offset: 0x" << offset << std::endl; 60 | } 61 | } m_kallsyms_markers; 62 | 63 | struct kallsyms_seqs_of_names_info { 64 | size_t offset = 0; 65 | void printf() { 66 | std::cout << std::hex << "kallsyms_seqs_of_names offset: 0x" << offset << std::endl; 67 | } 68 | } m_kallsyms_seqs_of_names; 69 | 70 | struct kallsyms_token_table_info { 71 | size_t offset = 0; 72 | void printf() { 73 | std::cout << std::hex << "kallsyms_token_table offset: 0x" << offset << std::endl; 74 | } 75 | } m_kallsyms_token_table; 76 | 77 | struct kallsyms_token_index_info { 78 | size_t offset = 0; 79 | void printf() { 80 | std::cout << std::hex << "kallsyms_token_index offset: 0x" << offset << std::endl; 81 | } 82 | } m_kallsyms_token_index; 83 | }; -------------------------------------------------------------------------------- /patch_kernel_root/analyze/kallsyms_lookup_name_6_6_30.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | #include 4 | class KallsymsLookupName_6_6_30 5 | { 6 | public: 7 | KallsymsLookupName_6_6_30(const std::vector& file_buf); 8 | ~KallsymsLookupName_6_6_30(); 9 | 10 | public: 11 | bool init(); 12 | bool is_inited(); 13 | uint64_t kallsyms_lookup_name(const char* name, bool include_str_mode = false); 14 | int get_kallsyms_num(); 15 | 16 | private: 17 | bool find_kallsyms_offsets_list(size_t& start, size_t& end); 18 | uint64_t find_kallsyms_relative_base(size_t offset_list_end, size_t& kallsyms_relative_base_offset); 19 | std::vector find_maybe_kallsyms_num(size_t offset_list_start, size_t offset_list_end); 20 | bool find_kallsyms_names_list(int kallsyms_num, size_t kallsyms_num_end_offset, size_t& name_list_start, size_t& name_list_end); 21 | bool find_kallsyms_markers_list(int kallsyms_num, size_t name_list_end_offset, size_t& markers_list_start, size_t& markers_list_end, bool & markers_list_is_align8); 22 | bool find_kallsyms_seqs_of_names_list(int kallsyms_num, size_t kallsyms_relative_base_end_offset, bool markers_list_is_align8, size_t& seqs_of_names_list_start, size_t& seqs_of_names_list_end); 23 | bool find_kallsyms_token_table(size_t kallsyms_markers_list_end_offset, size_t& kallsyms_token_table_start, size_t& kallsyms_token_table_end); 24 | bool find_kallsyms_token_index(size_t kallsyms_token_table_start, size_t& kallsyms_token_index_start); 25 | bool find_kallsyms_sym_func_entry_offset(size_t& kallsyms_sym_func_entry_offset); 26 | 27 | unsigned int kallsyms_expand_symbol(unsigned int off, char* result, size_t maxlen); 28 | uint64_t __kallsyms_lookup_name(const char* name, bool include_str_mode = false); 29 | int kallsyms_lookup_names(const char* name, unsigned int* start, unsigned int* end); 30 | unsigned int get_symbol_seq(int index); 31 | unsigned int get_symbol_offset(unsigned long pos); 32 | uint64_t kallsyms_sym_address(int idx); 33 | int compare_symbol_name(const char* name, char* namebuf); 34 | bool cleanup_symbol_name(char* s); 35 | 36 | const std::vector& m_file_buf; 37 | uint64_t m_kallsyms_relative_base = 0; 38 | int m_kallsyms_num = 0; 39 | bool m_inited = false; 40 | size_t m_kallsyms_sym_func_entry_offset = 0; 41 | 42 | struct kallsyms_offsets_info { 43 | size_t offset = 0; 44 | void printf() { 45 | std::cout << std::hex << "kallsyms_offsets offset: 0x" << offset << std::endl; 46 | } 47 | } m_kallsyms_offsets; 48 | 49 | struct kallsyms_names_info { 50 | size_t offset = 0; 51 | void printf() { 52 | std::cout << std::hex << "kallsyms_names offset: 0x" << offset << std::endl; 53 | } 54 | } m_kallsyms_names; 55 | 56 | struct kallsyms_markers_info { 57 | size_t offset = 0; 58 | void printf() { 59 | std::cout << std::hex << "kallsyms_markers offset: 0x" << offset << std::endl; 60 | } 61 | } m_kallsyms_markers; 62 | 63 | struct kallsyms_seqs_of_names_info { 64 | size_t offset = 0; 65 | void printf() { 66 | std::cout << std::hex << "kallsyms_seqs_of_names offset: 0x" << offset << std::endl; 67 | } 68 | } m_kallsyms_seqs_of_names; 69 | 70 | struct kallsyms_token_table_info { 71 | size_t offset = 0; 72 | void printf() { 73 | std::cout << std::hex << "kallsyms_token_table offset: 0x" << offset << std::endl; 74 | } 75 | } m_kallsyms_token_table; 76 | 77 | struct kallsyms_token_index_info { 78 | size_t offset = 0; 79 | void printf() { 80 | std::cout << std::hex << "kallsyms_token_index offset: 0x" << offset << std::endl; 81 | } 82 | } m_kallsyms_token_index; 83 | }; -------------------------------------------------------------------------------- /patch_kernel_root/analyze/kernel_symbol_parser.cpp: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include "kernel_symbol_parser.h" 3 | #include 4 | 5 | #ifndef MIN 6 | #define MIN(x, y)(x < y) ? (x) : (y) 7 | #endif // !MIN 8 | 9 | KernelSymbolParser::KernelSymbolParser(const std::vector& file_buf) : m_file_buf(file_buf), m_kernel_ver_parser(file_buf) 10 | , m_kallsyms_lookup_name_6_6_30(file_buf) 11 | , m_kallsyms_lookup_name_6_1_60(file_buf) 12 | , m_kallsyms_lookup_name_6_1_42(file_buf) 13 | , m_kallsyms_lookup_name_4_6_0(file_buf) 14 | , m_kallsyms_lookup_name(file_buf) 15 | { 16 | } 17 | 18 | KernelSymbolParser::~KernelSymbolParser() 19 | { 20 | } 21 | 22 | bool KernelSymbolParser::init_kallsyms_lookup_name() { 23 | 24 | std::string current_version = m_kernel_ver_parser.find_kernel_versions(); 25 | if (current_version.empty()) { 26 | std::cout << "Failed to read Linux kernel version" << std::endl; 27 | return false; 28 | } 29 | std::cout << "Find the current Linux kernel version: " << current_version << std::endl; 30 | std::cout << std::endl; 31 | 32 | if (m_kernel_ver_parser.is_version_less(current_version, "4.6.0")) { 33 | if (!m_kallsyms_lookup_name.init()) { 34 | std::cout << "Failed to analyze kernel kallsyms lookup name information" << std::endl; 35 | return false; 36 | } 37 | } else if (m_kernel_ver_parser.is_version_less(current_version, "6.1.42")) { 38 | if (!m_kallsyms_lookup_name_4_6_0.init()) { 39 | std::cout << "Failed to analyze kernel kallsyms lookup name information" << std::endl; 40 | return false; 41 | } 42 | } else if (m_kernel_ver_parser.is_version_less(current_version, "6.1.60")) { 43 | if (!m_kallsyms_lookup_name_6_1_42.init()) { 44 | std::cout << "Failed to analyze kernel kallsyms lookup name information" << std::endl; 45 | return false; 46 | } 47 | } else if (m_kernel_ver_parser.is_version_less(current_version, "6.6.30")) { 48 | if (!m_kallsyms_lookup_name_6_1_60.init()) { 49 | std::cout << "Failed to analyze kernel kallsyms lookup name information" << std::endl; 50 | return false; 51 | } 52 | } else { 53 | if (!m_kallsyms_lookup_name_6_6_30.init()) { 54 | std::cout << "Failed to analyze kernel kallsyms lookup name information" << std::endl; 55 | return false; 56 | } 57 | } 58 | return true; 59 | } 60 | 61 | uint64_t KernelSymbolParser::kallsyms_lookup_name(const char* name, bool include_str_mode) { 62 | if (m_kallsyms_lookup_name_6_6_30.is_inited()) { 63 | return m_kallsyms_lookup_name_6_6_30.kallsyms_lookup_name(name, include_str_mode); 64 | } else if (m_kallsyms_lookup_name_6_1_60.is_inited()) { 65 | return m_kallsyms_lookup_name_6_1_60.kallsyms_lookup_name(name, include_str_mode); 66 | } else if (m_kallsyms_lookup_name_6_1_42.is_inited()) { 67 | return m_kallsyms_lookup_name_6_1_42.kallsyms_lookup_name(name, include_str_mode); 68 | } else if (m_kallsyms_lookup_name_4_6_0.is_inited()) { 69 | return m_kallsyms_lookup_name_4_6_0.kallsyms_lookup_name(name, include_str_mode); 70 | } else if (m_kallsyms_lookup_name.is_inited()) { 71 | return m_kallsyms_lookup_name.kallsyms_lookup_name(name, include_str_mode); 72 | } else { 73 | return 0; 74 | } 75 | } 76 | 77 | bool KernelSymbolParser::is_kernel_version_less(const std::string& ver) const { 78 | std::string current_version = m_kernel_ver_parser.find_kernel_versions(); 79 | if (!current_version.empty()) { 80 | return m_kernel_ver_parser.is_version_less(current_version, ver); 81 | } 82 | return false; 83 | } 84 | -------------------------------------------------------------------------------- /patch_kernel_root/analyze/kernel_symbol_parser.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include "kernel_version_parser.h" 3 | #include "kallsyms_lookup_name.h" 4 | #include "kallsyms_lookup_name_4_6_0.h" 5 | #include "kallsyms_lookup_name_6_1_42.h" 6 | #include "kallsyms_lookup_name_6_1_60.h" 7 | #include "kallsyms_lookup_name_6_6_30.h" 8 | #include 9 | #include 10 | class KernelSymbolParser 11 | { 12 | public: 13 | KernelSymbolParser(const std::vector& file_buf); 14 | ~KernelSymbolParser(); 15 | 16 | public: 17 | bool init_kallsyms_lookup_name(); 18 | uint64_t kallsyms_lookup_name(const char* name, bool include_str_mode = false); 19 | bool is_kernel_version_less(const std::string& ver) const; 20 | private: 21 | const std::vector& m_file_buf; 22 | KernelVersionParser m_kernel_ver_parser; 23 | KallsymsLookupName m_kallsyms_lookup_name; 24 | KallsymsLookupName_4_6_0 m_kallsyms_lookup_name_4_6_0; 25 | KallsymsLookupName_6_1_42 m_kallsyms_lookup_name_6_1_42; 26 | KallsymsLookupName_6_1_60 m_kallsyms_lookup_name_6_1_60; 27 | KallsymsLookupName_6_6_30 m_kallsyms_lookup_name_6_6_30; 28 | }; -------------------------------------------------------------------------------- /patch_kernel_root/analyze/kernel_version_parser.cpp: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include "kernel_version_parser.h" 3 | #include 4 | 5 | #ifndef MIN 6 | #define MIN(x, y)(x < y) ? (x) : (y) 7 | #endif // !MIN 8 | 9 | KernelVersionParser::KernelVersionParser(const std::vector& file_buf) : m_file_buf(file_buf) 10 | { 11 | } 12 | 13 | KernelVersionParser::~KernelVersionParser() 14 | { 15 | } 16 | 17 | // Helper function to extract and print the version number starting from the given index 18 | std::string KernelVersionParser::extract_version(const std::vector& buffer, size_t start_index) const { 19 | std::string version; 20 | // Extract until we hit a non-version character or end of buffer 21 | while (start_index < buffer.size() && (isdigit(buffer[start_index]) || buffer[start_index] == '.')) { 22 | version.push_back(buffer[start_index]); 23 | ++start_index; 24 | } 25 | return version; 26 | } 27 | 28 | // Function to search for Linux version patterns using memcmp 29 | std::string KernelVersionParser::find_kernel_versions() const { 30 | const size_t safe_end = MIN(m_file_buf.size(), 256); 31 | const char* prefix = "Linux version "; 32 | const size_t prefix_len = strlen(prefix); 33 | 34 | for (size_t i = 0; i + prefix_len <= m_file_buf.size() - safe_end; ++i) { 35 | if (memcmp(m_file_buf.data() + i, prefix, prefix_len) == 0 && isdigit(m_file_buf[i + prefix_len])) { 36 | return extract_version(m_file_buf, i + prefix_len); 37 | } 38 | } 39 | return {}; 40 | } 41 | 42 | 43 | // Helper function to split the version string and convert to integers 44 | std::vector KernelVersionParser::parse_version(const std::string& version) const { 45 | std::vector parts; 46 | std::stringstream ss(version); 47 | std::string part; 48 | 49 | while (getline(ss, part, '.')) { 50 | parts.push_back(std::stoi(part)); 51 | } 52 | // Ensure we always have at least three parts (fill missing parts with zero) 53 | while (parts.size() < 3) { 54 | parts.push_back(0); 55 | } 56 | 57 | return parts; 58 | } 59 | 60 | // Function to compare two version numbers 61 | bool KernelVersionParser::is_version_less(const std::string& v1, const std::string& v2) const { 62 | auto parts1 = parse_version(v1); 63 | auto parts2 = parse_version(v2); 64 | 65 | // Compare major, minor, and patch versions 66 | for (int i = 0; i < 3; ++i) { 67 | if (parts1[i] < parts2[i]) return true; // If version 1 is less than version 2, return true 68 | if (parts1[i] > parts2[i]) return false; // If version 1 is greater than version 2, return false 69 | } 70 | 71 | // If all parts are equal, return false (i.e., v1 is not less than v2) 72 | return false; // If versions are equal, return false (strictly less) 73 | } 74 | -------------------------------------------------------------------------------- /patch_kernel_root/analyze/kernel_version_parser.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | #include 4 | class KernelVersionParser 5 | { 6 | public: 7 | KernelVersionParser(const std::vector & file_buf); 8 | ~KernelVersionParser(); 9 | 10 | public: 11 | std::string find_kernel_versions() const; 12 | bool is_version_less(const std::string& v1, const std::string& v2) const; 13 | private: 14 | std::string extract_version(const std::vector& buffer, size_t start_index) const; 15 | std::vector parse_version(const std::string& version) const; 16 | const std::vector& m_file_buf; 17 | }; -------------------------------------------------------------------------------- /patch_kernel_root/analyze/symbol_analyze.cpp: -------------------------------------------------------------------------------- 1 | #include "symbol_analyze.h" 2 | 3 | SymbolAnalyze::SymbolAnalyze(const std::vector& file_buf) : m_file_buf(file_buf), m_kernel_sym_parser(file_buf) 4 | { 5 | } 6 | 7 | SymbolAnalyze::~SymbolAnalyze() 8 | { 9 | } 10 | 11 | bool SymbolAnalyze::analyze_kernel_symbol() { 12 | if (!m_kernel_sym_parser.init_kallsyms_lookup_name()) { 13 | std::cout << "Failed to initialize kallsyms lookup name" << std::endl; 14 | return false; 15 | } 16 | if (!find_symbol_offset()) { 17 | std::cout << "Failed to find symbol offset" << std::endl; 18 | return false; 19 | } 20 | return true; 21 | } 22 | 23 | KernelSymbolOffset SymbolAnalyze::get_symbol_offset() { 24 | return m_kernel_sym_offset; 25 | } 26 | 27 | bool SymbolAnalyze::is_kernel_version_less(const std::string& ver) const { 28 | return m_kernel_sym_parser.is_kernel_version_less(ver); 29 | } 30 | 31 | bool SymbolAnalyze::find_symbol_offset() { 32 | m_kernel_sym_offset._text = m_kernel_sym_parser.kallsyms_lookup_name("_text"); 33 | m_kernel_sym_offset._stext = m_kernel_sym_parser.kallsyms_lookup_name("_stext"); 34 | 35 | m_kernel_sym_offset.die = m_kernel_sym_parser.kallsyms_lookup_name("die"); 36 | m_kernel_sym_offset.arm64_notify_die = m_kernel_sym_parser.kallsyms_lookup_name("arm64_notify_die"); 37 | m_kernel_sym_offset.kernel_restart = m_kernel_sym_parser.kallsyms_lookup_name("kernel_restart"); 38 | 39 | m_kernel_sym_offset.__do_execve_file = m_kernel_sym_parser.kallsyms_lookup_name("__do_execve_file"); 40 | 41 | m_kernel_sym_offset.do_execveat_common = m_kernel_sym_parser.kallsyms_lookup_name("do_execveat_common"); 42 | if (m_kernel_sym_offset.do_execveat_common == 0) { 43 | m_kernel_sym_offset.do_execveat_common = m_kernel_sym_parser.kallsyms_lookup_name("do_execveat_common", true); 44 | } 45 | 46 | m_kernel_sym_offset.do_execve_common = m_kernel_sym_parser.kallsyms_lookup_name("do_execve_common"); 47 | if (m_kernel_sym_offset.do_execve_common == 0) { 48 | m_kernel_sym_offset.do_execve_common = m_kernel_sym_parser.kallsyms_lookup_name("do_execve_common", true); 49 | } 50 | 51 | m_kernel_sym_offset.do_execveat = m_kernel_sym_parser.kallsyms_lookup_name("do_execveat"); 52 | m_kernel_sym_offset.do_execve = m_kernel_sym_parser.kallsyms_lookup_name("do_execve"); 53 | 54 | 55 | m_kernel_sym_offset.avc_denied = m_kernel_sym_parser.kallsyms_lookup_name("avc_denied"); 56 | if (m_kernel_sym_offset.avc_denied == 0) { 57 | m_kernel_sym_offset.avc_denied = m_kernel_sym_parser.kallsyms_lookup_name("avc_denied", true); 58 | } 59 | m_kernel_sym_offset.filldir64 = m_kernel_sym_parser.kallsyms_lookup_name("filldir64", true); 60 | m_kernel_sym_offset.freeze_task = m_kernel_sym_parser.kallsyms_lookup_name("freeze_task"); 61 | 62 | m_kernel_sym_offset.revert_creds = m_kernel_sym_parser.kallsyms_lookup_name("revert_creds"); 63 | m_kernel_sym_offset.prctl_get_seccomp = m_kernel_sym_parser.kallsyms_lookup_name("prctl_get_seccomp"); // backup: seccomp_filter_release 64 | 65 | 66 | m_kernel_sym_offset.__cfi_check = m_kernel_sym_parser.kallsyms_lookup_name("__cfi_check"); 67 | m_kernel_sym_offset.__cfi_check_fail = m_kernel_sym_parser.kallsyms_lookup_name("__cfi_check_fail"); 68 | m_kernel_sym_offset.__cfi_slowpath_diag = m_kernel_sym_parser.kallsyms_lookup_name("__cfi_slowpath_diag"); 69 | m_kernel_sym_offset.__cfi_slowpath = m_kernel_sym_parser.kallsyms_lookup_name("__cfi_slowpath"); 70 | m_kernel_sym_offset.__ubsan_handle_cfi_check_fail_abort = m_kernel_sym_parser.kallsyms_lookup_name("__ubsan_handle_cfi_check_fail_abort"); 71 | m_kernel_sym_offset.__ubsan_handle_cfi_check_fail = m_kernel_sym_parser.kallsyms_lookup_name("__ubsan_handle_cfi_check_fail"); 72 | m_kernel_sym_offset.report_cfi_failure = m_kernel_sym_parser.kallsyms_lookup_name("report_cfi_failure"); 73 | return (m_kernel_sym_offset.do_execve || m_kernel_sym_offset.do_execveat || m_kernel_sym_offset.do_execveat_common) 74 | && m_kernel_sym_offset.avc_denied 75 | && m_kernel_sym_offset.filldir64 76 | && m_kernel_sym_offset.freeze_task 77 | && m_kernel_sym_offset.revert_creds 78 | && m_kernel_sym_offset.prctl_get_seccomp; 79 | } -------------------------------------------------------------------------------- /patch_kernel_root/analyze/symbol_analyze.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include "kernel_symbol_parser.h" 3 | #include 4 | #include 5 | 6 | struct KernelSymbolOffset { 7 | size_t _text = 0; 8 | size_t _stext = 0; 9 | size_t die = 0; 10 | size_t arm64_notify_die = 0; 11 | size_t kernel_restart = 0; 12 | 13 | size_t __do_execve_file = 0; 14 | size_t do_execveat_common = 0; 15 | size_t do_execve_common = 0; 16 | size_t do_execveat = 0; 17 | size_t do_execve = 0; 18 | 19 | size_t avc_denied = 0; 20 | size_t filldir64 = 0; 21 | size_t freeze_task = 0; 22 | 23 | size_t revert_creds = 0; 24 | size_t prctl_get_seccomp = 0; 25 | 26 | 27 | size_t __cfi_check = 0; 28 | size_t __cfi_check_fail = 0; 29 | size_t __cfi_slowpath_diag = 0; 30 | size_t __cfi_slowpath = 0; 31 | size_t __ubsan_handle_cfi_check_fail_abort = 0; 32 | size_t __ubsan_handle_cfi_check_fail = 0; 33 | size_t report_cfi_failure = 0; 34 | }; 35 | 36 | class SymbolAnalyze 37 | { 38 | public: 39 | SymbolAnalyze(const std::vector & file_buf); 40 | ~SymbolAnalyze(); 41 | 42 | public: 43 | bool analyze_kernel_symbol(); 44 | KernelSymbolOffset get_symbol_offset(); 45 | bool is_kernel_version_less(const std::string& ver) const; 46 | private: 47 | bool find_symbol_offset(); 48 | const std::vector& m_file_buf; 49 | KernelSymbolParser m_kernel_sym_parser; 50 | KernelSymbolOffset m_kernel_sym_offset; 51 | }; -------------------------------------------------------------------------------- /patch_kernel_root/exe/aarch64-linux-android-as.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/patch_kernel_root/exe/aarch64-linux-android-as.exe -------------------------------------------------------------------------------- /patch_kernel_root/exe/arm-linux-androideabi-as.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/patch_kernel_root/exe/arm-linux-androideabi-as.exe -------------------------------------------------------------------------------- /patch_kernel_root/exe/patch_kernel_root.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/patch_kernel_root/exe/patch_kernel_root.exe -------------------------------------------------------------------------------- /patch_kernel_root/exe/快速扩充文件体积工具/QuicklyExpandFileSize.cpp: -------------------------------------------------------------------------------- 1 | // QuicklyExpandFileSize.cpp : 此文件包含 "main" 函数。程序执行将在此处开始并结束。 2 | // 3 | 4 | #include 5 | #include 6 | #include 7 | using namespace std; 8 | #define TARGET_BYTES 192*1024*1024 //目标体积大小 9 | int main(int argc, char *argv[]) { 10 | char *inimage = argv[0]; 11 | ++argv; 12 | --argc; 13 | 14 | cout << "本工具用于快速扩大boot.img的文件体积" << endl << endl; 15 | 16 | 17 | const char *lpszFilePath = argv[0]; 18 | FILE * pFile = fopen(lpszFilePath, "rb+"); 19 | if (!pFile) { 20 | cout << "打开文件失败:" << lpszFilePath << endl; 21 | system("pause"); 22 | return 0; 23 | } 24 | fseek(pFile, 0, SEEK_END); 25 | auto nSize = ftell(pFile); 26 | rewind(pFile); 27 | if (nSize >= TARGET_BYTES) { 28 | cout << "目标文件体积已经大于" << TARGET_BYTES / 1024 / 1024 << "MB，无需再扩大" << endl; 29 | system("pause"); 30 | return 0; 31 | } 32 | 33 | fseek(pFile, 0, SEEK_END); 34 | auto writeSize = TARGET_BYTES - nSize; 35 | void * pEmptySize = malloc(writeSize); 36 | if (!pEmptySize) { 37 | cout << "申请内存大小" << writeSize << "字节，失败" << endl; 38 | system("pause"); 39 | return 0; 40 | } 41 | fwrite((char*)pEmptySize, writeSize, 1, pFile); 42 | free(pEmptySize); 43 | fclose(pFile); 44 | cout << "目标文件体积扩充完毕：" << TARGET_BYTES / 1024 / 1024 << "MB" << endl; 45 | system("pause"); 46 | return 0; 47 | } 48 | -------------------------------------------------------------------------------- /patch_kernel_root/exe/快速扩充文件体积工具/QuicklyExpandFileSize128M.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/patch_kernel_root/exe/快速扩充文件体积工具/QuicklyExpandFileSize128M.exe -------------------------------------------------------------------------------- /patch_kernel_root/exe/快速扩充文件体积工具/QuicklyExpandFileSize192M.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/patch_kernel_root/exe/快速扩充文件体积工具/QuicklyExpandFileSize192M.exe -------------------------------------------------------------------------------- /patch_kernel_root/exe/快速扩充文件体积工具/QuicklyExpandFileSize64.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/patch_kernel_root/exe/快速扩充文件体积工具/QuicklyExpandFileSize64.exe -------------------------------------------------------------------------------- /patch_kernel_root/exe/快速扩充文件体积工具/QuicklyExpandFileSize96.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/patch_kernel_root/exe/快速扩充文件体积工具/QuicklyExpandFileSize96.exe -------------------------------------------------------------------------------- /patch_kernel_root/exe/快速扩充文件体积工具/用法：将kernel文件拖拽至exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/patch_kernel_root/exe/快速扩充文件体积工具/用法：将kernel文件拖拽至exe -------------------------------------------------------------------------------- /patch_kernel_root/patch_avc_denied.cpp: -------------------------------------------------------------------------------- 1 | #include "patch_avc_denied.h" 2 | #include "analyze/base_func.h" 3 | #include "analyze/ARM_asm.h" 4 | PatchAvcDenied::PatchAvcDenied(const std::vector& file_buf, const KernelSymbolOffset& sym, 5 | const SymbolAnalyze& symbol_analyze) : PatchBase(file_buf, sym, symbol_analyze) { 6 | 7 | } 8 | 9 | PatchAvcDenied::~PatchAvcDenied() 10 | { 11 | } 12 | 13 | int PatchAvcDenied::get_need_read_cap_cnt() { 14 | int cnt = get_cap_cnt(); 15 | if (cnt < 5) { 16 | cnt = 3; 17 | } 18 | return cnt; 19 | } 20 | 21 | 22 | size_t PatchAvcDenied::patch_avc_denied(size_t hook_func_start_addr, const std::vector& task_struct_offset_cred, 23 | std::vector& vec_out_patch_bytes_data) { 24 | size_t avc_denied_addr = m_sym.avc_denied; 25 | int atomic_usage_len = get_cred_atomic_usage_len(); 26 | int securebits_padding = get_cred_securebits_padding(); 27 | std::string cap_ability_max = get_cap_ability_max(); 28 | int cap_cnt = get_need_read_cap_cnt(); 29 | 30 | size_t avc_denied_entry_hook_jump_back_addr = avc_denied_addr + 4; 31 | std::stringstream sstrAsm; 32 | sstrAsm 33 | << "STP X7, X8, [sp, #-16]!" << std::endl 34 | << "STP X9, X10, [sp, #-16]!" << std::endl; 35 | sstrAsm << "MRS X7, SP_EL0" << std::endl; 36 | for (auto x = 0; x < task_struct_offset_cred.size(); x++) { 37 | if (x != task_struct_offset_cred.size() - 1) { 38 | sstrAsm << "LDR X7, [X7, #" << task_struct_offset_cred[x] << "]" << std::endl; 39 | } 40 | } 41 | sstrAsm << "LDR X7, [X7, #" << task_struct_offset_cred[task_struct_offset_cred.size() - 1] << "]" << std::endl 42 | << "CBZ X7, #JUMP_END" << std::endl 43 | << "ADD X7, X7, #" << atomic_usage_len << std::endl 44 | << "MOV X8, #8" << std::endl 45 | << "LABEL_CYCLE_UID:" 46 | << "LDR W9, [X7], #4" << std::endl 47 | << "CBNZ W9, #JUMP_END" << std::endl 48 | << "SUBS X8, X8, #1" << std::endl 49 | << "B.NE #JUMP_CYCLE_UID" << std::endl 50 | << "MOV W8, 0xC" << std::endl 51 | << "LDR W9, [X7], #" << 4 + securebits_padding << std::endl 52 | << "CMP W8, W9" << std::endl 53 | << "B.NE #JUMP_END" << std::endl 54 | << "MOV X8, " << cap_ability_max << std::endl 55 | << "MOV X9, #" << cap_cnt << std::endl 56 | << "LABEL_CYCLE_CAP:" 57 | << "LDR X10, [X7], #8" << std::endl 58 | << "CMP X10, X8" << std::endl 59 | << "B.CC #JUMP_END" << std::endl 60 | << "SUBS X9, X9, #1" << std::endl 61 | << "B.NE #JUMP_CYCLE_CAP" << std::endl 62 | << "LDP X9, X10, [sp], #16" << std::endl 63 | << "LDP X7, X8, [sp], #16" << std::endl 64 | << "MOV W0, WZR" << std::endl 65 | << "RET" << std::endl 66 | << "LABEL_END:" 67 | << "LDP X9, X10, [sp], #16" << std::endl 68 | << "LDP X7, X8, [sp], #16" << std::endl 69 | << "MOV X0, X0" << std::endl; 70 | size_t end_order_len = count_endl(sstrAsm.str()) * 4; 71 | sstrAsm<< "B #" << (int64_t)(avc_denied_entry_hook_jump_back_addr - (hook_func_start_addr + end_order_len)) << std::endl; 72 | 73 | std::string strAsmCode = AsmLabelToOffset(sstrAsm.str(), "LABEL_END:", "JUMP_END"); 74 | strAsmCode = AsmLabelToOffset(strAsmCode, "LABEL_CYCLE_UID:", "JUMP_CYCLE_UID"); 75 | strAsmCode = AsmLabelToOffset(strAsmCode, "LABEL_CYCLE_CAP:", "JUMP_CYCLE_CAP"); 76 | std::cout << std::endl << strAsmCode << std::endl; 77 | 78 | std::string strBytes = AsmToBytes(strAsmCode); 79 | if (!strBytes.length()) { 80 | return 0; 81 | } 82 | size_t nHookFuncSize = strBytes.length() / 2; 83 | 84 | char hookOrigCmd[4] = { 0 }; 85 | memcpy(&hookOrigCmd, (void*)((size_t)&m_file_buf[0] + avc_denied_addr), sizeof(hookOrigCmd)); 86 | std::string strHookOrigCmd = bytes2hex((const unsigned char*)hookOrigCmd, sizeof(hookOrigCmd)); 87 | 88 | end_order_len = (count_endl(sstrAsm.str()) - 2) * 4; 89 | strBytes = strBytes.substr(0, (end_order_len) * 2) + strHookOrigCmd + strBytes.substr((end_order_len + 4) * 2); 90 | 91 | vec_out_patch_bytes_data.push_back({ strBytes, hook_func_start_addr }); 92 | std::stringstream sstrAsm2; 93 | sstrAsm2 94 | << "B #" << (int64_t)(hook_func_start_addr - avc_denied_addr) << std::endl; 95 | std::string strBytes2 = AsmToBytes(sstrAsm2.str()); 96 | if (!strBytes2.length()) { 97 | return 0; 98 | } 99 | vec_out_patch_bytes_data.push_back({ strBytes2, avc_denied_addr }); 100 | hook_func_start_addr += nHookFuncSize; 101 | std::cout << "#下一段HOOK函数起始可写位置：" << std::hex << hook_func_start_addr << std::endl << std::endl; 102 | return hook_func_start_addr 103 | } 104 | -------------------------------------------------------------------------------- /patch_kernel_root/patch_avc_denied.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | #include 4 | #include "patch_base.h" 5 | class PatchAvcDenied : public PatchBase 6 | { 7 | public: 8 | PatchAvcDenied(const std::vector& file_buf, const KernelSymbolOffset& sym, 9 | const SymbolAnalyze& symbol_analyze); 10 | ~PatchAvcDenied(); 11 | 12 | size_t patch_avc_denied(size_t hook_func_start_addr, const std::vector& task_struct_offset_cred, 13 | std::vector& vec_out_patch_bytes_data); 14 | 15 | private: 16 | int get_need_read_cap_cnt(); 17 | }; -------------------------------------------------------------------------------- /patch_kernel_root/patch_base.cpp: -------------------------------------------------------------------------------- 1 | #include "patch_base.h" 2 | #include "analyze/ARM_asm.h" 3 | PatchBase::PatchBase(const std::vector& file_buf, const KernelSymbolOffset& sym, 4 | const SymbolAnalyze& symbol_analyze) : m_file_buf(file_buf), m_sym(sym), m_symbol_analyze(symbol_analyze) { 5 | 6 | } 7 | 8 | PatchBase::~PatchBase() 9 | { 10 | } 11 | 12 | int PatchBase::get_cred_atomic_usage_len() { 13 | int len = 8; 14 | if (m_symbol_analyze.is_kernel_version_less("6.6.0")) { 15 | len = 4; 16 | } 17 | return len; 18 | } 19 | 20 | int PatchBase::get_cred_securebits_padding() { 21 | if (get_cred_atomic_usage_len() == 8) { 22 | return 4; 23 | } 24 | return 0; 25 | } 26 | 27 | std::string PatchBase::get_cap_ability_max() { 28 | std::string cap; 29 | if (m_symbol_analyze.is_kernel_version_less("5.8.0")) { 30 | cap = "0x3FFFFFFFFF"; 31 | } 32 | else if (m_symbol_analyze.is_kernel_version_less("5.9.0")) { 33 | cap = "0xFFFFFFFFFF"; 34 | } 35 | else { 36 | cap = "0x1FFFFFFFFFF"; 37 | } 38 | return cap; 39 | } 40 | 41 | int PatchBase::get_cap_cnt() { 42 | int cnt = 0; 43 | if (m_symbol_analyze.is_kernel_version_less("4.3.0")) { 44 | cnt = 4; 45 | } else { 46 | cnt = 5; 47 | } 48 | return cnt; 49 | } -------------------------------------------------------------------------------- /patch_kernel_root/patch_base.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | #include 4 | #include "patch_kernel_root.h" 5 | #include "analyze/symbol_analyze.h" 6 | class PatchBase 7 | { 8 | public: 9 | PatchBase(const std::vector& file_buf, const KernelSymbolOffset& sym, 10 | const SymbolAnalyze& symbol_analyze); 11 | ~PatchBase(); 12 | protected: 13 | int get_cred_atomic_usage_len(); 14 | int get_cred_securebits_padding(); 15 | std::string get_cap_ability_max(); 16 | int get_cap_cnt(); 17 | const std::vector& m_file_buf; 18 | const KernelSymbolOffset& m_sym; 19 | const SymbolAnalyze& m_symbol_analyze; 20 | }; -------------------------------------------------------------------------------- /patch_kernel_root/patch_do_execve.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | #include 4 | #include "patch_base.h" 5 | class PatchDoExecve : public PatchBase 6 | { 7 | public: 8 | PatchDoExecve(const std::vector& file_buf, const KernelSymbolOffset& sym, 9 | const SymbolAnalyze& symbol_analyze); 10 | ~PatchDoExecve(); 11 | 12 | size_t patch_do_execve(const std::string& str_root_key, size_t hook_func_start_addr, 13 | const std::vector& task_struct_offset_cred, 14 | const std::vector& task_struct_offset_seccomp, 15 | std::vector& vec_out_patch_bytes_data); 16 | 17 | private: 18 | std::pair get_do_execve_param(); 19 | int get_need_write_cap_cnt(); 20 | }; -------------------------------------------------------------------------------- /patch_kernel_root/patch_filldir64.cpp: -------------------------------------------------------------------------------- 1 | #include "patch_filldir64.h" 2 | #include "analyze/base_func.h" 3 | #include "analyze/ARM_asm.h" 4 | PatchFilldir64::PatchFilldir64(const std::vector& file_buf, const KernelSymbolOffset& sym, 5 | const SymbolAnalyze& symbol_analyze) : PatchBase(file_buf, sym, symbol_analyze) { 6 | 7 | } 8 | 9 | PatchFilldir64::~PatchFilldir64() 10 | { 11 | } 12 | 13 | size_t PatchFilldir64::patch_filldir64(size_t root_key_addr_offset, size_t hook_func_start_addr, std::vector& vec_out_patch_bytes_data) { 14 | size_t filldir64_addr = m_sym.filldir64; 15 | 16 | size_t filldir64_entry_hook_jump_back_addr = filldir64_addr + 4; 17 | std::stringstream sstrAsm; 18 | sstrAsm 19 | << "CMP W2, #16" << std::endl 20 | << "BNE #JUMP_DIRECT_END" << std::endl 21 | << "STP X7, X8, [sp, #-16]!" << std::endl 22 | << "STP X9, X10, [sp, #-16]!" << std::endl; 23 | size_t end_order_cnt = count_endl(sstrAsm.str()); 24 | int root_key_adr_offset = root_key_addr_offset - (hook_func_start_addr + end_order_cnt * 4); 25 | sstrAsm << "ADR X7, #" << root_key_adr_offset << std::endl 26 | << "MOV X8, #0" << std::endl 27 | << "LABEL_CYCLE_NAME:" 28 | << "LDRB W9, [X1, X8]" << std::endl 29 | << "LDRB W10, [X7, X8]" << std::endl 30 | << "CMP W9, W10" << std::endl 31 | << "B.NE #JUMP_END" << std::endl 32 | << "ADD X8, X8, 1" << std::endl 33 | << "CMP X8, #16" << std::endl 34 | << "BLT #JUMP_CYCLE_NAME" << std::endl 35 | << "LDP X9, X10, [sp], #16" << std::endl 36 | << "LDP X7, X8, [sp], #16" << std::endl 37 | << "MOV X0, XZR" << std::endl 38 | << "RET" << std::endl 39 | << "LABEL_END:" 40 | << "LDP X9, X10, [sp], #16" << std::endl 41 | << "LDP X7, X8, [sp], #16" << std::endl 42 | << "LABEL_DIRECT_END:" 43 | << "MOV X0, X0" << std::endl; 44 | size_t end_order_len = count_endl(sstrAsm.str()) * 4; 45 | sstrAsm << "B #" << (int64_t)(filldir64_entry_hook_jump_back_addr - (hook_func_start_addr + end_order_len)) << std::endl; 46 | 47 | std::string strAsmCode = AsmLabelToOffset(sstrAsm.str(), "LABEL_END:", "JUMP_END"); 48 | strAsmCode = AsmLabelToOffset(strAsmCode, "LABEL_DIRECT_END:", "JUMP_DIRECT_END"); 49 | strAsmCode = AsmLabelToOffset(strAsmCode, "LABEL_CYCLE_NAME:", "JUMP_CYCLE_NAME"); 50 | std::cout << std::endl << strAsmCode << std::endl; 51 | 52 | std::string strBytes = AsmToBytes(strAsmCode); 53 | if (!strBytes.length()) { 54 | return 0; 55 | } 56 | size_t nHookFuncSize = strBytes.length() / 2; 57 | char hookOrigCmd[4] = { 0 }; 58 | memcpy(&hookOrigCmd, (void*)((size_t)&m_file_buf[0] + filldir64_addr), sizeof(hookOrigCmd)); 59 | std::string strHookOrigCmd = bytes2hex((const unsigned char*)hookOrigCmd, sizeof(hookOrigCmd)); 60 | strBytes = strBytes.substr(0, (0x4C) * 2) + strHookOrigCmd + strBytes.substr((0x4C + 4) * 2); 61 | 62 | vec_out_patch_bytes_data.push_back({ strBytes, hook_func_start_addr }); 63 | std::stringstream sstrAsm2; 64 | sstrAsm2 65 | << "B #" << (int64_t)(hook_func_start_addr - filldir64_addr) << std::endl; 66 | std::string strBytes2 = AsmToBytes(sstrAsm2.str()); 67 | if (!strBytes2.length()) { 68 | return 0; 69 | } 70 | vec_out_patch_bytes_data.push_back({ strBytes2, filldir64_addr }); 71 | hook_func_start_addr += nHookFuncSize; 72 | std::cout << "#下一段HOOK函数起始可写位置：" << std::hex << hook_func_start_addr << std::endl << std::endl; 73 | return hook_func_start_addr; 74 | } 75 | -------------------------------------------------------------------------------- /patch_kernel_root/patch_filldir64.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | #include 4 | #include "patch_base.h" 5 | class PatchFilldir64 : public PatchBase 6 | { 7 | public: 8 | PatchFilldir64(const std::vector& file_buf, const KernelSymbolOffset& sym, 9 | const SymbolAnalyze& symbol_analyze); 10 | ~PatchFilldir64(); 11 | 12 | size_t patch_filldir64(size_t root_key_addr_offset, size_t hook_func_start_addr, std::vector& vec_out_patch_bytes_data); 13 | }; -------------------------------------------------------------------------------- /patch_kernel_root/patch_freeze_task.cpp: -------------------------------------------------------------------------------- 1 | #include "patch_freeze_task.h" 2 | #include "analyze/base_func.h" 3 | #include "analyze/ARM_asm.h" 4 | PatchFreezeTask::PatchFreezeTask(const std::vector& file_buf, const KernelSymbolOffset& sym, 5 | const SymbolAnalyze& symbol_analyze) : PatchBase(file_buf, sym, symbol_analyze) { 6 | 7 | } 8 | 9 | PatchFreezeTask::~PatchFreezeTask() 10 | { 11 | } 12 | 13 | int PatchFreezeTask::get_need_read_cap_cnt() { 14 | int cnt = get_cap_cnt(); 15 | if (cnt < 5) { 16 | cnt = 3; 17 | } 18 | return cnt; 19 | } 20 | 21 | 22 | size_t PatchFreezeTask::patch_freeze_task(size_t hook_func_start_addr, const std::vector& task_struct_offset_cred, 23 | std::vector& vec_out_patch_bytes_data) { 24 | size_t freeze_task_addr = m_sym.freeze_task; 25 | int atomic_usage_len = get_cred_atomic_usage_len(); 26 | 27 | size_t freeze_task_entry_hook_jump_back_addr = freeze_task_addr + 4; 28 | std::stringstream sstrAsm; 29 | sstrAsm 30 | << "STP X7, X8, [sp, #-16]!" << std::endl 31 | << "STP X9, X10, [sp, #-16]!" << std::endl; 32 | sstrAsm << "MOV X7, X0" << std::endl; 33 | for (auto x = 0; x < task_struct_offset_cred.size(); x++) { 34 | if (x != task_struct_offset_cred.size() - 1) { 35 | sstrAsm << "LDR X7, [X7, #" << task_struct_offset_cred[x] << "]" << std::endl; 36 | } 37 | } 38 | sstrAsm << "LDR X7, [X7, #" << task_struct_offset_cred[task_struct_offset_cred.size() - 1] << "]" << std::endl 39 | << "CBZ X7, #JUMP_END" << std::endl 40 | << "ADD X7, X7, #" << atomic_usage_len << std::endl 41 | << "MOV X8, #8" << std::endl 42 | << "LABEL_CYCLE_UID:" 43 | << "LDR W9, [X7], #4" << std::endl 44 | << "CBNZ W9, #JUMP_END" << std::endl 45 | << "SUBS X8, X8, #1" << std::endl 46 | << "B.NE #JUMP_CYCLE_UID" << std::endl 47 | << "LDP X9, X10, [sp], #16" << std::endl 48 | << "LDP X7, X8, [sp], #16" << std::endl 49 | << "MOV W0, WZR" << std::endl 50 | << "RET" << std::endl 51 | << "LABEL_END:" 52 | << "LDP X9, X10, [sp], #16" << std::endl 53 | << "LDP X7, X8, [sp], #16" << std::endl 54 | << "MOV X0, X0" << std::endl; 55 | size_t end_order_len = count_endl(sstrAsm.str()) * 4; 56 | sstrAsm << "B #" << freeze_task_entry_hook_jump_back_addr - (hook_func_start_addr + end_order_len) << std::endl; 57 | 58 | std::string strAsmCode = AsmLabelToOffset(sstrAsm.str(), "LABEL_END:", "JUMP_END"); 59 | strAsmCode = AsmLabelToOffset(strAsmCode, "LABEL_CYCLE_UID:", "JUMP_CYCLE_UID"); 60 | std::cout << std::endl << strAsmCode << std::endl; 61 | 62 | std::string strBytes = AsmToBytes(strAsmCode); 63 | if (!strBytes.length()) { 64 | return 0; 65 | } 66 | size_t nHookFuncSize = strBytes.length() / 2; 67 | 68 | char hookOrigCmd[4] = { 0 }; 69 | memcpy(&hookOrigCmd, (void*)((size_t)&m_file_buf[0] + freeze_task_addr), sizeof(hookOrigCmd)); 70 | std::string strHookOrigCmd = bytes2hex((const unsigned char*)hookOrigCmd, sizeof(hookOrigCmd)); 71 | 72 | end_order_len = (count_endl(sstrAsm.str()) - 2) * 4; 73 | strBytes = strBytes.substr(0, (end_order_len) * 2) + strHookOrigCmd + strBytes.substr((end_order_len + 4) * 2); 74 | 75 | vec_out_patch_bytes_data.push_back({ strBytes, hook_func_start_addr }); 76 | 77 | std::stringstream sstrAsm2; 78 | sstrAsm2 79 | << "B #" << (int64_t)(hook_func_start_addr - freeze_task_addr) << std::endl; 80 | std::string strBytes2 = AsmToBytes(sstrAsm2.str()); 81 | if (!strBytes2.length()) { 82 | return 0; 83 | } 84 | vec_out_patch_bytes_data.push_back({ strBytes2, freeze_task_addr }); 85 | hook_func_start_addr += nHookFuncSize; 86 | std::cout << "#下一段HOOK函数起始可写位置：" << std::hex << hook_func_start_addr << std::endl << std::endl; 87 | return hook_func_start_addr; 88 | } 89 | -------------------------------------------------------------------------------- /patch_kernel_root/patch_freeze_task.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | #include 4 | #include "patch_base.h" 5 | class PatchFreezeTask : public PatchBase 6 | { 7 | public: 8 | PatchFreezeTask(const std::vector& file_buf, const KernelSymbolOffset& sym, 9 | const SymbolAnalyze& symbol_analyze); 10 | ~PatchFreezeTask(); 11 | 12 | size_t patch_freeze_task(size_t hook_func_start_addr, const std::vector& task_struct_offset_cred, 13 | std::vector& vec_out_patch_bytes_data); 14 | 15 | private: 16 | int get_need_read_cap_cnt(); 17 | }; -------------------------------------------------------------------------------- /patch_kernel_root/patch_kernel_root.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | struct patch_bytes_data { 4 | std::string str_bytes; 5 | size_t write_addr = 0; 6 | }; 7 | -------------------------------------------------------------------------------- /patch_kernel_root/patch_kernel_root.vcxproj.user: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | true 5 | 6 | -------------------------------------------------------------------------------- /testRoot/jni/Android.mk: -------------------------------------------------------------------------------- 1 | LOCAL_PATH := $(call my-dir) 2 | 3 | include $(CLEAR_VARS) 4 | LOCAL_CPPFLAGS += -std=c++17 -fPIE -fvisibility=hidden -frtti -fexceptions 5 | LOCAL_LDFLAGS += -fPIE -pie 6 | LOCAL_DISABLE_FATAL_LINKER_WARNINGS := true 7 | LOCAL_MODULE := testRoot 8 | LOCAL_SRC_FILES := \ 9 | testRoot.cpp \ 10 | kernel_root_kit/kernel_root_kit_process64_inject.cpp \ 11 | kernel_root_kit/kernel_root_kit_ptrace_arm64_utils.cpp \ 12 | kernel_root_kit/kernel_root_kit_su_install_helper.cpp \ 13 | kernel_root_kit/kernel_root_kit_parasite_app.cpp \ 14 | kernel_root_kit/kernel_root_kit_parasite_patch_elf.cpp \ 15 | kernel_root_kit/kernel_root_kit_upx_helper.cpp 16 | include $(BUILD_EXECUTABLE) 17 | -------------------------------------------------------------------------------- /testRoot/jni/Application.mk: -------------------------------------------------------------------------------- 1 | APP_ABI := arm64-v8a 2 | APP_STL := c++_static -------------------------------------------------------------------------------- /testRoot/jni/Build.bat: -------------------------------------------------------------------------------- 1 | @echo off 2 | set "ndk_path=c:\Users\abc\android-ndk-r25\ndk-build.cmd" 3 | 4 | cd /d "%~dp0" 5 | 6 | set "root_path=%~dp0" 7 | 8 | cd %root_path% 9 | call Clean.bat 10 | 11 | if not exist %ndk_path% ( 12 | echo Error: Android NDK: '%ndk_path%' does not exist! 13 | pause 14 | exit /b 15 | ) 16 | 17 | call "%ndk_path%" clean 18 | 19 | cd %root_path%\su\jni 20 | call "%ndk_path%" clean 21 | call "%ndk_path%" 22 | 23 | cd %root_path%\su 24 | call generate_source_su_exec_data.bat 25 | 26 | cd %root_path%\lib_su_env\jni 27 | call "%ndk_path%" clean 28 | call "%ndk_path%" 29 | 30 | cd %root_path%\lib_su_env 31 | call generate_source_lib_su_env_data.bat 32 | 33 | cd %root_path%\upx 34 | call generate_source_upx_data.bat 35 | 36 | cd %root_path%\lib_root_server 37 | call generate_source_lib_root_server_html_data.bat 38 | cd %root_path%\lib_root_server\jni 39 | call "%ndk_path%" clean 40 | call "%ndk_path%" 41 | 42 | cd %root_path%\lib_root_server 43 | call generate_source_lib_root_server_data.bat 44 | 45 | cd %root_path% 46 | call "%ndk_path%" 47 | 48 | echo All builds completed! 49 | pause 50 | -------------------------------------------------------------------------------- /testRoot/jni/Clean.bat: -------------------------------------------------------------------------------- 1 | @echo off 2 | cd /d "%~dp0" 3 | 4 | set "root_path=%~dp0" 5 | 6 | if exist kernel_root_kit\kernel_root_kit_lib_root_server_data.h ( 7 | del kernel_root_kit\kernel_root_kit_lib_root_server_data.h 8 | ) 9 | 10 | if exist kernel_root_kit\kernel_root_kit_su_exec_data.h ( 11 | del kernel_root_kit\kernel_root_kit_su_exec_data.h 12 | ) 13 | 14 | if exist kernel_root_kit\kernel_root_kit_lib_su_env_data.h ( 15 | del kernel_root_kit\kernel_root_kit_lib_su_env_data.h 16 | ) 17 | 18 | if exist kernel_root_kit\kernel_root_kit_upx_data.h ( 19 | del kernel_root_kit\kernel_root_kit_upx_data.h 20 | ) 21 | 22 | if exist su\res.h ( 23 | del su\res.h 24 | ) 25 | 26 | if exist lib_su_env\res.h ( 27 | del lib_su_env\res.h 28 | ) 29 | 30 | if exist lib_root_server\res.h ( 31 | del lib_root_server\res.h 32 | ) 33 | 34 | if exist lib_root_server\index.gz.bin ( 35 | del lib_root_server\index.gz.bin 36 | ) 37 | 38 | if exist lib_root_server\index_html_gz_data.h ( 39 | del lib_root_server\index_html_gz_data.h 40 | ) 41 | 42 | if exist upx\res.h ( 43 | del upx\res.h 44 | ) 45 | 46 | if exist "%root_path%\su\libs" ( 47 | rmdir /S /Q "%root_path%\su\libs" 48 | ) 49 | 50 | if exist "%root_path%\su\obj" ( 51 | rmdir /S /Q "%root_path%\su\obj" 52 | ) 53 | 54 | if exist "%root_path%\lib_su_env\libs" ( 55 | rmdir /S /Q "%root_path%\lib_su_env\libs" 56 | ) 57 | 58 | if exist "%root_path%\lib_su_env\obj" ( 59 | rmdir /S /Q "%root_path%\lib_su_env\obj" 60 | ) 61 | 62 | if exist "%root_path%\lib_root_server\libs" ( 63 | rmdir /S /Q "%root_path%\lib_root_server\libs" 64 | ) 65 | 66 | if exist "%root_path%\lib_root_server\obj" ( 67 | rmdir /S /Q "%root_path%\lib_root_server\obj" 68 | ) 69 | 70 | if exist "%root_path%\..\libs" ( 71 | rmdir /S /Q "%root_path%\..\libs" 72 | ) 73 | 74 | if exist "%root_path%\..\obj" ( 75 | rmdir /S /Q "%root_path%\..\obj" 76 | ) 77 | -------------------------------------------------------------------------------- /testRoot/jni/kernel_root_kit/file_convert_to_source_tools/file_convert_to_source_tools.cpp: -------------------------------------------------------------------------------- 1 | // file_convert_to_source_tools.cpp : 此文件包含 "main" 函数。程序执行将在此处开始并结束。 2 | // 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | 9 | void OutputSourceFile(const std::string& sourceCode, int nFileSize, int nBuffValCount) { 10 | std::ofstream file("res.h"); 11 | if (!file) { 12 | std::cerr << "无法打开输出文件 res.h\n"; 13 | return; 14 | } 15 | 16 | file << "namespace {\n"; 17 | file << "static int fileSize = " << nFileSize << ";\n"; 18 | file << "static uint64_t data[" << nBuffValCount << "] = {\n"; 19 | file << sourceCode << "\n"; 20 | file << "};\n"; 21 | file << "}\n"; 22 | } 23 | 24 | void processFile(const std::string& filePath) { 25 | std::ifstream file(filePath, std::ios::binary | std::ios::ate); 26 | if (!file) { 27 | std::cerr << "打开文件失败: " << filePath << "\n"; 28 | return; 29 | } 30 | 31 | std::streamsize nFileSize = file.tellg(); 32 | file.seekg(0, std::ios::beg); 33 | 34 | std::vector buffer(nFileSize); 35 | if (!file.read(buffer.data(), nFileSize)) { 36 | std::cerr << "读取文件失败: " << filePath << "\n"; 37 | return; 38 | } 39 | 40 | int yu = nFileSize % 8; 41 | if (yu > 0) { 42 | yu = 8 - yu; 43 | } 44 | buffer.resize(nFileSize + yu, 0); // 扩大并填充零 45 | 46 | std::ostringstream code; 47 | for (int i = 0; i < buffer.size() / 8; i++) { 48 | uint64_t val = *(uint64_t*)&buffer[i * 8]; 49 | if (i > 0) { 50 | code << ", "; 51 | if (i % 3 == 0) { 52 | code << "\n"; 53 | } 54 | } 55 | code << "0x" << std::hex << val; 56 | } 57 | 58 | OutputSourceFile(code.str(), nFileSize, buffer.size() / 8); 59 | std::cout << "完成\n"; 60 | } 61 | 62 | int main(int argc, char* argv[]) { 63 | #ifdef _DEBUG 64 | const char* filePath = R"***(D:\123.txt)***"; 65 | #else 66 | if (argc < 2) { 67 | std::cerr << "无输入文件\n"; 68 | return 1; 69 | } 70 | const char* filePath = argv[1]; 71 | #endif 72 | 73 | processFile(filePath); 74 | std::cin.get(); 75 | return 0; 76 | } 77 | -------------------------------------------------------------------------------- /testRoot/jni/kernel_root_kit/file_convert_to_source_tools/file_convert_to_source_tools.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/testRoot/jni/kernel_root_kit/file_convert_to_source_tools/file_convert_to_source_tools.exe -------------------------------------------------------------------------------- /testRoot/jni/kernel_root_kit/kernel_root_kit_command.h: -------------------------------------------------------------------------------- 1 | #ifndef _KERNEL_ROOT_KIT_COMMAND_H_ 2 | #define _KERNEL_ROOT_KIT_COMMAND_H_ 3 | 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include 18 | 19 | #include 20 | 21 | #include "kernel_root_kit_err_def.h" 22 | #include "kernel_root_kit_fork_helper.h" 23 | 24 | namespace kernel_root { 25 | //获取ROOT权限，返回值为0则代表成功 26 | static inline ssize_t get_root(const char* str_root_key) { 27 | if(getuid() == 0) { return ERR_NONE; } 28 | if (str_root_key == NULL) { return ERR_PARAM; } 29 | syscall(__NR_execve, str_root_key, NULL, NULL); 30 | if(getuid() != 0) { return ERR_NO_ROOT; } 31 | return ERR_NONE; 32 | } 33 | 34 | //检查系统SELinux的是否为禁用状态 35 | static bool is_enable_selinux() { 36 | int cnt = 0; 37 | DIR* dir = opendir("/"); 38 | if (NULL != dir) { 39 | struct dirent* ptr = NULL; 40 | while ((ptr = readdir(dir)) != NULL) { 41 | if ((strcmp(ptr->d_name, ".") == 0) || (strcmp(ptr->d_name, "..") == 0)) { 42 | continue; 43 | } 44 | cnt++; 45 | } 46 | closedir(dir); 47 | } 48 | return cnt > 5 ? false : true; 49 | } 50 | 51 | //执行root命令，返回值为0则代表成功 52 | static std::string run_root_cmd(const char* str_root_key, const char* cmd, ssize_t & err) { 53 | if (str_root_key == NULL || cmd == NULL || strlen(cmd) == 0) { 54 | err = ERR_PARAM; 55 | return {}; 56 | } 57 | //把错误信息也打出来 58 | std::string cmd_add_err_info = cmd; 59 | cmd_add_err_info += " 2>&1"; 60 | 61 | std::string result; 62 | fork_pipe_info finfo; 63 | if(fork_pipe_child_process(finfo)) { 64 | err = ERR_NONE; 65 | do { 66 | if (get_root(str_root_key) != ERR_NONE) { 67 | err = ERR_NO_ROOT; 68 | break; 69 | } 70 | FILE * fp = popen(cmd_add_err_info.c_str(), "r"); 71 | if(!fp) { 72 | err = ERR_POPEN; 73 | break; 74 | } 75 | int pip = fileno(fp); 76 | while(true) { 77 | char rbuf[1024] = {0}; 78 | ssize_t r = read(pip, rbuf, sizeof(rbuf)); 79 | if (r == -1 && errno == EAGAIN) { 80 | continue; //意味着现在没有可用的数据,以后再试一次 81 | } else if(r > 0) { 82 | std::string str_convert(rbuf, r); 83 | result += str_convert; 84 | } else { 85 | break; 86 | } 87 | } 88 | pclose(fp); 89 | } while(0); 90 | write_errcode_from_child(finfo, err); 91 | write_string_from_child(finfo, result); 92 | _exit(0); 93 | return {}; 94 | } 95 | err = ERR_NONE; 96 | if(!wait_fork_child_process(finfo)) { 97 | err = ERR_WAIT_FORK_CHILD; 98 | } else { 99 | if(!read_errcode_from_child(finfo, err)) { 100 | err = ERR_READ_CHILD_ERRCODE; 101 | } else if(!read_string_from_child(finfo, result)) { 102 | err = ERR_READ_CHILD_STRING; 103 | } 104 | } 105 | return result; 106 | } 107 | } 108 | #endif /* _KERNEL_ROOT_KIT_COMMAND_H_ */ 109 | -------------------------------------------------------------------------------- /testRoot/jni/kernel_root_kit/kernel_root_kit_elf64_symbol_parser.h: -------------------------------------------------------------------------------- 1 | #ifndef _KERNEL_ROOT_KIT_SO_SYMBOL_PARSER_H_ 2 | #define _KERNEL_ROOT_KIT_SO_SYMBOL_PARSER_H_ 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | 16 | #include "kernel_root_kit_err_def.h" 17 | namespace kernel_root { 18 | 19 | struct dl_iterate_callback_data { 20 | const char *target_so_name; 21 | std::shared_ptr> sp_func_symbol_map; 22 | }; 23 | 24 | 25 | static bool is_elf64_file(int fd) { 26 | Elf64_Ehdr elf; 27 | int r = read(fd, &elf, sizeof(elf)); 28 | if (r != sizeof(elf)) { 29 | return false; 30 | } 31 | if (*(uint32_t*)&elf != 0x464c457f) { 32 | //not an ELF file 33 | return false; 34 | } 35 | unsigned char* b = (unsigned char*)&elf; 36 | if (b[EI_CLASS] == ELFCLASS64) { 37 | return true; 38 | } 39 | return false; 40 | } 41 | 42 | static int read_elf64_file_symbol_addr(const char* so_path, std::map& func_symbol_map) { 43 | int fd; 44 | char* mod; 45 | unsigned int size, i, j, shn, n; 46 | Elf64_Sym* syms, * sym; 47 | Elf64_Shdr* shdrs, * shdr; 48 | Elf64_Ehdr* ehdr; 49 | const char* strtab; 50 | 51 | fd = open(so_path, O_RDONLY); 52 | if (fd < 0) { 53 | return ERR_OPEN_FILE; 54 | } 55 | lseek(fd, 0L, SEEK_SET); 56 | if (!is_elf64_file(fd)) { 57 | close(fd); 58 | return ERR_NOT_ELF64_FILE; 59 | } 60 | size = lseek(fd, 0L, SEEK_END); 61 | mod = (char*)mmap(NULL, size, PROT_READ, MAP_PRIVATE, fd, 0); 62 | 63 | ehdr = (Elf64_Ehdr*)mod; 64 | shdrs = (Elf64_Shdr*)(mod + ehdr->e_shoff); 65 | shn = ehdr->e_shnum == 0 ? shdrs[0].sh_size : ehdr->e_shnum; 66 | 67 | for (i = 0; i < shn; i++) { 68 | shdr = &shdrs[i]; 69 | 70 | if (shdr->sh_type == SHT_SYMTAB || shdr->sh_type == SHT_DYNSYM) { 71 | syms = (Elf64_Sym*)(mod + shdr->sh_offset); 72 | strtab = mod + shdrs[shdr->sh_link].sh_offset; 73 | n = shdr->sh_size / shdr->sh_entsize; 74 | for (j = 0; j < n; j++) { 75 | char stype, sbind, sinfo; 76 | 77 | sym = &syms[j]; 78 | stype = ELF64_ST_TYPE(sym->st_info); 79 | sbind = ELF32_ST_BIND(sym->st_info); 80 | sinfo = ELF32_ST_INFO(sbind, stype); 81 | if (stype == STT_FUNC && sbind == STB_GLOBAL && 82 | sym->st_other == STV_DEFAULT && 83 | (uintmax_t)sym->st_size > 0) { 84 | 85 | auto iter = func_symbol_map.find(strtab + sym->st_name); 86 | if (iter == func_symbol_map.end()) { 87 | continue; 88 | } 89 | iter->second = sym->st_value; 90 | } 91 | } 92 | } 93 | } 94 | munmap(mod, size); 95 | close(fd); 96 | return ERR_NONE; 97 | } 98 | 99 | int find_mem_elf64_symbol_address(const char *so_path, std::map& func_symbol_map) { 100 | void* p_so_addr = get_module_base(-1, so_path); 101 | void* p_so = dlopen(so_path, RTLD_NOW | RTLD_GLOBAL); 102 | if (!p_so || !p_so_addr) { 103 | return ERR_DLOPEN_FILE; 104 | } 105 | for(auto iter = func_symbol_map.begin(); iter != func_symbol_map.end(); iter++) { 106 | void* pfunc = dlsym(p_so, iter->first.c_str()); 107 | if(pfunc) { 108 | iter->second = ((size_t)pfunc - (size_t)p_so_addr); 109 | } 110 | } 111 | dlclose(p_so); 112 | return ERR_NONE; 113 | } 114 | 115 | } 116 | #endif /* _KERNEL_ROOT_KIT_SO_SYMBOL_PARSER_H_ */ 117 | -------------------------------------------------------------------------------- /testRoot/jni/kernel_root_kit/kernel_root_kit_err_def.h: -------------------------------------------------------------------------------- 1 | #ifndef _KERNEL_ROOT_ERR_DEF_H_ 2 | #define _KERNEL_ROOT_ERR_DEF_H_ 3 | 4 | #define EXTRA_ERR_MULT 1000 5 | enum KERNEL_ROOT_ERR{ 6 | ERR_NONE = 0, 7 | ERR_PARAM = -1000, 8 | ERR_NO_ROOT, 9 | ERR_WAIT_FORK_CHILD, 10 | ERR_READ_CHILD_ERRCODE, 11 | ERR_READ_CHILD_STRING, 12 | ERR_READ_CHILD_INT, 13 | ERR_READ_CHILD_SET_ARR, 14 | ERR_READ_CHILD_MAP_I_S, 15 | ERR_READ_CHILD_MAP_S_I, 16 | ERR_READ_EOF, 17 | ERR_NO_MEM, 18 | ERR_EXECVE, 19 | ERR_KILL, 20 | ERR_APP_DIR, 21 | ERR_FIND_CMDLINE_PROC, 22 | ERR_EXIST_32BIT, 23 | ERR_NOT_EXIST_ORIGINAL_FILE, 24 | ERR_NOT_EXIST_IMPLANT_FILE, 25 | ERR_CHMOD, 26 | ERR_COPY_SELINUX, 27 | ERR_LINK_SO, 28 | ERR_CHECK_LINK_SO, 29 | ERR_NOT_FOUND_LIBC, 30 | ERR_LOAD_LIBC_FUNC_ADDR, 31 | ERR_INJECT_PROC64_ENV, 32 | ERR_INJECT_PROC64_SO, 33 | ERR_INJECT_PROC64_RUN_EXIT, 34 | ERR_LIBC_PATH_EMPTY, 35 | ERR_CREATE_SU_HIDE_FOLDER, 36 | ERR_WRITE_ROOT_SERVER, 37 | ERR_WRITE_SU_ENV_SO_FILE, 38 | ERR_WRITE_SU_EXEC, 39 | ERR_WRITE_UPX, 40 | ERR_SET_FILE_ALLOW_ACCESS, 41 | ERR_UPX, 42 | ERR_DELETE_FILE, 43 | ERR_POPEN, 44 | ERR_OPEN_FILE, 45 | ERR_OPEN_DIR, 46 | ERR_NOT_ELF64_FILE, 47 | ERR_DLOPEN_FILE, 48 | }; 49 | 50 | #endif /* _KERNEL_ROOT_ERR_DEF_H_ */ 51 | -------------------------------------------------------------------------------- /testRoot/jni/kernel_root_kit/kernel_root_kit_exec_process.h: -------------------------------------------------------------------------------- 1 | #ifndef _KERNEL_ROOT_KIT_EXEC_PROCESS_H_ 2 | #define _KERNEL_ROOT_KIT_EXEC_PROCESS_H_ 3 | 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | 17 | #include 18 | 19 | #include "kernel_root_kit_command.h" 20 | 21 | namespace kernel_root { 22 | //以root身份直接执行程序 23 | static ssize_t root_exec_process(const char* str_root_key, const char *file_path) { 24 | int err = ERR_NONE; 25 | if (file_path == NULL || strlen(file_path) == 0) { return ERR_PARAM; } 26 | 27 | if (kernel_root::get_root(str_root_key) != ERR_NONE) { 28 | return ERR_NO_ROOT; 29 | } 30 | 31 | char *buf1 = strdup(file_path); 32 | size_t argc = 0; 33 | char *saveptr; 34 | for (char *tok = strtok_r(buf1, " ", &saveptr); 35 | tok; 36 | tok = strtok_r(NULL, " ", &saveptr)) { 37 | argc++; 38 | } 39 | free(buf1); 40 | 41 | char *buf2 = strdup(file_path); 42 | char **argv = static_cast(calloc(argc + 1, sizeof(char*))); 43 | size_t idx = 0; 44 | for (char *tok = strtok_r(buf2, " ", &saveptr); 45 | tok; 46 | tok = strtok_r(NULL, " ", &saveptr)) { 47 | argv[idx++] = tok; 48 | } 49 | argv[idx] = NULL; 50 | execve(argv[0], argv, environ); 51 | err = ERR_EXECVE * EXTRA_ERR_MULT + -errno; 52 | free(argv); 53 | free(buf2); 54 | return err; 55 | } 56 | 57 | //fork安全版本（可用于安卓APP直接调用） 58 | static ssize_t safe_root_exec_process( 59 | const char* str_root_key, 60 | const char *file_path) { 61 | if (file_path == NULL || strlen(file_path) == 0) { return ERR_PARAM; } 62 | 63 | fork_pipe_info finfo; 64 | if (fork_pipe_child_process(finfo)) { 65 | ssize_t err = root_exec_process(str_root_key, file_path); 66 | write_errcode_from_child(finfo, err); 67 | _exit(0); 68 | return ERR_NONE; 69 | } 70 | ssize_t err = ERR_NONE; 71 | if (!wait_fork_child_process(finfo)) { 72 | err = ERR_WAIT_FORK_CHILD; 73 | } else if (!read_errcode_from_child(finfo, err)) { 74 | if(err == ERR_READ_EOF) { 75 | return ERR_NONE; 76 | } 77 | } 78 | return err; 79 | } 80 | } 81 | #endif /* _KERNEL_ROOT_KIT_EXEC_PROCESS_H_ */ 82 | -------------------------------------------------------------------------------- /testRoot/jni/kernel_root_kit/kernel_root_kit_log.h: -------------------------------------------------------------------------------- 1 | #ifndef _KERNEL_ROOT_KIT_LOG_H_ 2 | #define _KERNEL_ROOT_KIT_LOG_H_ 3 | #include 4 | namespace kernel_root { 5 | #define QUIET_KERNEL_ROOT_KIT_PRINTF 6 | 7 | #ifdef QUIET_KERNEL_ROOT_KIT_PRINTF 8 | #undef ROOT_PRINTF 9 | #define ROOT_PRINTF(fmt, ...) 10 | #else 11 | #ifdef __ANDROID__ 12 | #undef ROOT_PRINTF 13 | #include 14 | //#define ROOT_PRINTF(...) __android_log_print(ANDROID_LOG_ERROR, "JNIkernel_root", __VA_ARGS__) 15 | #define ROOT_PRINTF(fmt, ...) printf(fmt, ##__VA_ARGS__) 16 | #else 17 | #define ROOT_PRINTF(fmt, ...) printf(fmt, ##__VA_ARGS__) 18 | #endif 19 | #endif 20 | } 21 | #endif /* _KERNEL_ROOT_KIT_LOG_H_ */ 22 | -------------------------------------------------------------------------------- /testRoot/jni/kernel_root_kit/kernel_root_kit_maps_helper.h: -------------------------------------------------------------------------------- 1 | #ifndef _KERNEL_ROOT_KIT_MAPS_HELPER_H_ 2 | #define _KERNEL_ROOT_KIT_MAPS_HELPER_H_ 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | 11 | namespace kernel_root { 12 | static std::string find_process_libc_so_path(pid_t pid) { 13 | char line[1024] = { 0 }; 14 | std::string so_path; 15 | char filename[32]; 16 | if (pid < 0) { 17 | /* self process */ 18 | snprintf(filename, sizeof(filename), "/proc/self/maps"); 19 | } else { 20 | snprintf(filename, sizeof(filename), "/proc/%d/maps", pid); 21 | } 22 | FILE* fp = fopen(filename, "r"); 23 | if (fp != NULL) { 24 | while (fgets(line, sizeof(line), fp)) { 25 | if (strstr(line, "libc.so")) { 26 | 27 | char* start = strstr(line, "/"); 28 | if (start) { 29 | start[strlen(start) - 1] = '\0'; 30 | so_path = start; 31 | } 32 | break; 33 | } 34 | } 35 | 36 | fclose(fp); 37 | } 38 | 39 | return so_path; 40 | } 41 | 42 | static void* get_module_base(pid_t pid, const char* module_name) { 43 | FILE* fp; 44 | long addr = 0; 45 | char* pch; 46 | char filename[32]; 47 | char line[1024]; 48 | 49 | if (pid < 0) { 50 | snprintf(filename, sizeof(filename), "/proc/self/maps"); 51 | } else { 52 | snprintf(filename, sizeof(filename), "/proc/%d/maps", pid); 53 | } 54 | 55 | fp = fopen(filename, "r"); 56 | 57 | if (fp != NULL) { 58 | while (fgets(line, sizeof(line), fp)) { 59 | if (strstr(line, module_name)) { 60 | //分解字符串为一组字符串。line为要分解的字符串，"-"为分隔符字符串。 61 | pch = strtok(line, "-"); 62 | if(pch) { 63 | //将参数pch字符串根据参数base(表示进制)来转换成无符号的长整型数 64 | addr = strtoull(pch, NULL, 16); 65 | break; 66 | } 67 | } 68 | } 69 | fclose(fp); 70 | } 71 | 72 | return (void*)addr; 73 | } 74 | 75 | static std::set get_all_so_paths(pid_t pid) { 76 | char line[1024] = { 0 }; 77 | std::set so_paths; 78 | char filename[32] = { 0 }; 79 | 80 | if (pid < 0) { 81 | snprintf(filename, sizeof(filename), "/proc/self/maps"); 82 | } else { 83 | snprintf(filename, sizeof(filename), "/proc/%d/maps", pid); 84 | } 85 | 86 | FILE* fp = fopen(filename, "r"); 87 | if (fp != NULL) { 88 | while (fgets(line, sizeof(line), fp)) { 89 | if (strstr(line, ".so")) { 90 | char* start = strstr(line, "/"); 91 | if (start) { 92 | char* end = strchr(start, '\n'); 93 | if (end) { 94 | *end = '\0'; 95 | so_paths.insert(std::string(start)); 96 | } 97 | } 98 | } 99 | } 100 | fclose(fp); 101 | } 102 | 103 | return so_paths; 104 | } 105 | 106 | static std::string get_app_directory(const char* package_name) { 107 | if(!package_name || strlen(package_name) == 0) { return {}; } 108 | char line[4096] = { 0 }; 109 | char filename[1024] = { 0 }; 110 | snprintf(filename, sizeof(filename), "pm path %s", package_name); 111 | FILE * fp = popen(filename, "r"); 112 | if (fp) { 113 | fread(line, 1, sizeof(line), fp); 114 | pclose(fp); 115 | } 116 | std::string app_path = line; 117 | auto start = app_path.find("/"); 118 | if(start != std::string::npos) { 119 | app_path = app_path.substr(start); 120 | } 121 | auto end = app_path.find_last_of("/"); 122 | if(end != std::string::npos) { 123 | app_path = app_path.substr(0, end); 124 | } 125 | return app_path; 126 | } 127 | } 128 | #endif /* _KERNEL_ROOT_KIT_MAPS_HELPER_H_ */ 129 | -------------------------------------------------------------------------------- /testRoot/jni/kernel_root_kit/kernel_root_kit_parasite_app.h: -------------------------------------------------------------------------------- 1 | #ifndef _KERNEL_ROOT_KIT_PARASITE_APP_H_ 2 | #define _KERNEL_ROOT_KIT_PARASITE_APP_H_ 3 | #include 4 | #include 5 | namespace kernel_root { 6 | enum app_so_status { 7 | unknow = 0, 8 | running, 9 | not_running 10 | }; 11 | 12 | ssize_t parasite_precheck_app(const char* str_root_key, const char* target_pid_cmdline, std::map &output_so_full_path); 13 | //fork安全版本（可用于安卓APP直接调用） 14 | ssize_t safe_parasite_precheck_app(const char* str_root_key, const char* target_pid_cmdline, std::map &output_so_full_path); 15 | 16 | #ifndef LIB_ROOT_SERVER_MODE 17 | ssize_t parasite_implant_app(const char* str_root_key, const char* target_pid_cmdline, const char* original_so_full_path, const char* su_path); 18 | //fork安全版本（可用于安卓APP直接调用） 19 | ssize_t safe_parasite_implant_app(const char* str_root_key, const char* target_pid_cmdline, const char* original_so_full_path, const char* su_path); 20 | #endif 21 | 22 | ssize_t parasite_implant_su_env(const char* str_root_key, const char* target_pid_cmdline, const char* original_so_full_path, std::string_view su_folder); 23 | //fork安全版本（可用于安卓APP直接调用） 24 | ssize_t safe_parasite_implant_su_env(const char* str_root_key, const char* target_pid_cmdline, const char* original_so_full_path, std::string_view su_folder); 25 | } 26 | #endif /* _KERNEL_ROOT_KIT_PARASITE_APP_H_ */ 27 | -------------------------------------------------------------------------------- /testRoot/jni/kernel_root_kit/kernel_root_kit_parasite_patch_elf.h: -------------------------------------------------------------------------------- 1 | #ifndef _KERNEL_ROOT_KIT_PARASITE_PATCH_ELF_H_ 2 | #define _KERNEL_ROOT_KIT_PARASITE_PATCH_ELF_H_ 3 | #include 4 | namespace kernel_root { 5 | int parasite_check_so_link(const char* original_so_file_path, 6 | const char* implant_so_file_path); 7 | 8 | int parasite_start_link_so(const char* original_so_file_path, 9 | const char* implant_so_file_path); 10 | } 11 | #endif /* _KERNEL_ROOT_KIT_PARASITE_PATCH_ELF_H_ */ 12 | -------------------------------------------------------------------------------- /testRoot/jni/kernel_root_kit/kernel_root_kit_process64_inject.h: -------------------------------------------------------------------------------- 1 | #ifndef _KERNEL_ROOT_KIT__PROCESS64_INJECT_H_ 2 | #define _KERNEL_ROOT_KIT__PROCESS64_INJECT_H_ 3 | #include 4 | #include 5 | 6 | namespace kernel_root { 7 | 8 | enum class api_offset_read_mode { 9 | only_read_file, 10 | only_read_myself_mem, 11 | all 12 | }; 13 | 14 | //注入64位进程远程执行命令 15 | struct process64_env { 16 | char key[0x1000]; //key和name的值不能大于pagesize 17 | char value[0x1000]; 18 | }; 19 | 20 | //注入远程进程添加PATH变量路径 21 | ssize_t inject_process_env64_PATH_wrapper(const char* str_root_key, int target_pid, const char *add_path, 22 | api_offset_read_mode api_mode = api_offset_read_mode::all); 23 | //fork安全版本（可用于安卓APP直接调用） 24 | ssize_t safe_inject_process_env64_PATH_wrapper(const char* str_root_key, int target_pid, const char *add_path, 25 | api_offset_read_mode api_mode = api_offset_read_mode::all); 26 | 27 | ssize_t kill_process(const char* str_root_key, pid_t pid); 28 | ssize_t safe_kill_process(const char* str_root_key, pid_t pid); 29 | } 30 | #endif /* _KERNEL_ROOT_KIT__PROCESS64_INJECT_H_ */ 31 | -------------------------------------------------------------------------------- /testRoot/jni/kernel_root_kit/kernel_root_kit_ptrace_arm64_utils.h: -------------------------------------------------------------------------------- 1 | #ifndef _KERNEL_ROOT_KIT_PTRACE_ARM64_UTILS_H_ 2 | #define _KERNEL_ROOT_KIT_PTRACE_ARM64_UTILS_H_ 3 | #include 4 | #include 5 | 6 | 7 | namespace kernel_root { 8 | #ifndef __aarch64__ 9 | #error "Not supported" 10 | #endif 11 | 12 | #define pt_regs user_pt_regs 13 | #define uregs regs 14 | #define ARM_pc pc 15 | #define ARM_sp sp 16 | #define ARM_cpsr pstate 17 | #define ARM_lr regs[30] 18 | #define ARM_r0 regs[0] 19 | 20 | #define CPSR_T_MASK ( 1u << 5 ) 21 | #define MAX_PATH 256 22 | 23 | int ptrace_readdata(pid_t pid, uint8_t *src, uint8_t *buf, size_t size); 24 | /* 25 | Func : 将size字节的data数据写入到pid进程的dest地址处 26 | @param dest: 目的进程的栈地址 27 | @param data: 需要写入的数据的起始地址 28 | @param size: 需要写入的数据的大小，以字节为单位 29 | */ 30 | int ptrace_writedata(pid_t pid, uint8_t *dest, uint8_t *data, size_t size); 31 | 32 | int ptrace_getregs(pid_t pid, struct pt_regs * regs); 33 | 34 | int ptrace_setregs(pid_t pid, struct pt_regs * regs); 35 | 36 | int ptrace_continue(pid_t pid); 37 | int ptrace_attach(pid_t pid); 38 | 39 | int ptrace_detach(pid_t pid); 40 | 41 | uint64_t ptrace_retval(struct pt_regs * regs); 42 | 43 | uint64_t ptrace_ip(struct pt_regs * regs); 44 | //总结一下ptrace_call_wrapper，它的完成两个功能： 45 | //一是调用ptrace_call函数来执行指定函数，执行完后将子进程挂起； 46 | //二是调用ptrace_getregs函数获取所有寄存器的值，主要是为了获取r0即函数的返回值。 47 | int ptrace_call_wrapper(pid_t target_pid, const char * func_name, void * func_addr, unsigned long * parameters, int param_num, struct pt_regs * regs); 48 | /* 49 | 功能总结： 50 | 1，将要执行的指令写入寄存器中，指令长度大于4个long的话，需要将剩余的指令通过ptrace_writedata函数写入栈中； 51 | 2，使用ptrace_continue函数运行目的进程，直到目的进程返回状态值0xb7f（对该值的分析见后面红字）； 52 | 3，函数执行完之后，目标进程挂起，使用ptrace_getregs函数获取当前的所有寄存器值，方便后面使用ptrace_retval函数获取函数的返回值。 53 | */ 54 | int ptrace_call(pid_t pid, uintptr_t addr, unsigned long *params, int num_params, struct pt_regs* regs); 55 | } 56 | #endif /* _KERNEL_ROOT_KIT_PTRACE_ARM64_UTILS_H_ */ 57 | -------------------------------------------------------------------------------- /testRoot/jni/kernel_root_kit/kernel_root_kit_random.h: -------------------------------------------------------------------------------- 1 | #ifndef _KERNEL_ROOT_KIT_RANDOM_APP_H_ 2 | #define _KERNEL_ROOT_KIT_RANDOM_APP_H_ 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | namespace { 9 | static void rand_str_small(char* dest, int n) { 10 | int i, randno; 11 | char stardstring[27] = "abcdefghijklmnopqrstuvwxyz"; 12 | srand((unsigned)time(NULL)); 13 | for (i = 0; i < n; i++) { 14 | randno = rand() % 26; 15 | *dest = stardstring[randno]; 16 | dest++; 17 | } 18 | *dest = '\0'; 19 | } 20 | 21 | static void generate_lib_name(char* dest) { 22 | int len = rand() % 4 + 3; 23 | sprintf(dest, "lib"); 24 | rand_str_small(dest + 4, len); 25 | strcat(dest, ".so"); 26 | } 27 | 28 | } 29 | #endif /* _KERNEL_ROOT_KIT_RANDOM_APP_H_ */ 30 | -------------------------------------------------------------------------------- /testRoot/jni/kernel_root_kit/kernel_root_kit_su_install_helper.cpp: -------------------------------------------------------------------------------- 1 | #include "kernel_root_kit_su_install_helper.h" 2 | #include "kernel_root_kit_command.h" 3 | #include "kernel_root_kit_su_exec_data.h" 4 | #include "kernel_root_kit_log.h" 5 | #include "../su/su_hide_path_utils.h" 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | namespace kernel_root { 16 | 17 | bool write_su_exec(const char* target_path) { 18 | std::ofstream file(std::string(target_path), std::ios::binary | std::ios::out); 19 | if (!file.is_open()) { 20 | ROOT_PRINTF("Could not open file %s.\n", target_path); 21 | return false; 22 | } 23 | file.write(reinterpret_cast(su_exec_data), su_exec_file_size); 24 | file.close(); 25 | return true; 26 | } 27 | 28 | std::string install_su(const char* str_root_key, const char* base_path, ssize_t& err) { 29 | if (kernel_root::get_root(str_root_key) != ERR_NONE) { 30 | err = ERR_NO_ROOT; 31 | return {}; 32 | } 33 | 34 | //1.获取su_xxx隐藏目录 35 | std::string _su_hide_folder_path = kernel_root::su::find_su_hide_folder_path(str_root_key, base_path); 36 | if (_su_hide_folder_path.empty()) { 37 | //2.取不到，那就创建一个 38 | _su_hide_folder_path = kernel_root::su::create_su_hide_folder(str_root_key, base_path); 39 | } 40 | if (_su_hide_folder_path.empty()) { 41 | ROOT_PRINTF("su hide folder path empty error.\n"); 42 | err = ERR_CREATE_SU_HIDE_FOLDER; 43 | return {}; 44 | } 45 | std::string su_hide_full_path = _su_hide_folder_path + "/su"; 46 | if(!std::filesystem::exists(su_hide_full_path.c_str())) { 47 | if (!write_su_exec(su_hide_full_path.c_str())) { 48 | ROOT_PRINTF("copy file error.\n"); 49 | err = ERR_WRITE_SU_EXEC; 50 | return {}; 51 | } 52 | if (!kernel_root::su::set_file_allow_access_mode(su_hide_full_path)) { 53 | ROOT_PRINTF("set file allow access mode error.\n"); 54 | err = ERR_SET_FILE_ALLOW_ACCESS; 55 | return {}; 56 | } 57 | } 58 | err = ERR_NONE; 59 | return su_hide_full_path; 60 | } 61 | 62 | std::string safe_install_su(const char* str_root_key, const char* base_path, ssize_t& err) { 63 | std::string su_hide_full_path; 64 | fork_pipe_info finfo; 65 | if(fork_pipe_child_process(finfo)) { 66 | ssize_t err; 67 | su_hide_full_path = install_su(str_root_key, base_path, err); 68 | write_errcode_from_child(finfo, err); 69 | write_string_from_child(finfo, su_hide_full_path); 70 | _exit(0); 71 | return 0; 72 | } 73 | err = ERR_NONE; 74 | if(!wait_fork_child_process(finfo)) { 75 | err = ERR_WAIT_FORK_CHILD; 76 | } else { 77 | if(!read_errcode_from_child(finfo, err)) { 78 | err = ERR_READ_CHILD_ERRCODE; 79 | } else if(!read_string_from_child(finfo, su_hide_full_path)) { 80 | err = ERR_READ_CHILD_STRING; 81 | } 82 | } 83 | return su_hide_full_path; 84 | } 85 | 86 | ssize_t uninstall_su(const char* str_root_key, const char* base_path) { 87 | 88 | if (kernel_root::get_root(str_root_key) != ERR_NONE) { 89 | return ERR_NO_ROOT; 90 | } 91 | do { 92 | std::string _su_hide_path = kernel_root::su::find_su_hide_folder_path(str_root_key, base_path); 93 | if (_su_hide_path.empty()) { 94 | break; 95 | } 96 | remove(std::string(_su_hide_path + std::string("/su")).c_str()); 97 | } while (1); 98 | return kernel_root::su::del_su_hide_folder(str_root_key, base_path) ? -512 : 0; 99 | } 100 | 101 | ssize_t safe_uninstall_su(const char* str_root_key, const char* base_path) { 102 | ssize_t err = ERR_NONE; 103 | fork_pipe_info finfo; 104 | if(fork_pipe_child_process(finfo)) { 105 | err = uninstall_su(str_root_key, base_path); 106 | write_errcode_from_child(finfo, err); 107 | _exit(0); 108 | return ERR_NONE; 109 | } 110 | if(!wait_fork_child_process(finfo)) { 111 | err = ERR_WAIT_FORK_CHILD; 112 | } else { 113 | if(!read_errcode_from_child(finfo, err)) { 114 | err = ERR_READ_CHILD_ERRCODE; 115 | } 116 | } 117 | return err; 118 | } 119 | } 120 | 121 | 122 | 123 | -------------------------------------------------------------------------------- /testRoot/jni/kernel_root_kit/kernel_root_kit_su_install_helper.h: -------------------------------------------------------------------------------- 1 | #ifndef _KERNEL_ROOT_KIT_SU_INSTALL_HELPER_H_ 2 | #define _KERNEL_ROOT_KIT_SU_INSTALL_HELPER_H_ 3 | #include 4 | namespace kernel_root { 5 | std::string install_su(const char* str_root_key, const char* base_path, ssize_t & err); 6 | 7 | std::string safe_install_su(const char* str_root_key, const char* base_path, ssize_t& err); 8 | 9 | ssize_t uninstall_su(const char* str_root_key, const char* base_path); 10 | //fork安全版本（可用于安卓APP直接调用） 11 | ssize_t safe_uninstall_su(const char* str_root_key, const char* base_path); 12 | } 13 | #endif /* _KERNEL_ROOT_KIT_SU_INSTALL_HELPER_H_ */ 14 | -------------------------------------------------------------------------------- /testRoot/jni/kernel_root_kit/kernel_root_kit_umbrella.h: -------------------------------------------------------------------------------- 1 | #ifndef KERNEL_ROOT_KIT_UMBRELLA_H_ 2 | #define KERNEL_ROOT_KIT_UMBRELLA_H_ 3 | #include "kernel_root_kit_command.h" 4 | #include "kernel_root_kit_exec_process.h" 5 | #include "kernel_root_kit_process64_inject.h" 6 | #include "kernel_root_kit_process_cmdline_utils.h" 7 | #include "kernel_root_kit_su_install_helper.h" 8 | #include "kernel_root_kit_parasite_app.h" 9 | #endif /* KERNEL_ROOT_KIT_UMBRELLA_H_ */ 10 | -------------------------------------------------------------------------------- /testRoot/jni/kernel_root_kit/kernel_root_kit_upx_helper.cpp: -------------------------------------------------------------------------------- 1 | #include "kernel_root_kit_upx_helper.h" 2 | #include "kernel_root_kit_upx_data.h" 3 | #include "kernel_root_kit_exec_process.h" 4 | #include "kernel_root_kit_log.h" 5 | #include "../su/su_hide_path_utils.h" 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | namespace kernel_root { 17 | 18 | bool write_upx_exec(const char* target_path) { 19 | std::ofstream file(std::string(target_path), std::ios::binary | std::ios::out); 20 | if (!file.is_open()) { 21 | ROOT_PRINTF("Could not open file %s.\n", target_path); 22 | return false; 23 | } 24 | file.write(reinterpret_cast(upx_file_data), upx_file_size); 25 | file.close(); 26 | return true; 27 | } 28 | 29 | ssize_t upx_file(const char* str_root_key, const char* file_path) { 30 | if (kernel_root::get_root(str_root_key) != ERR_NONE) { 31 | return ERR_NO_ROOT; 32 | } 33 | std::filesystem::path path(file_path); 34 | std::string folder_path = path.parent_path().string(); 35 | std::string upx_full_path = folder_path + "/upx"; 36 | 37 | if(!write_upx_exec(upx_full_path.c_str())) { 38 | return ERR_WRITE_UPX; 39 | } 40 | 41 | std::string file_path_upx = file_path; 42 | file_path_upx += ".upx"; 43 | 44 | std::random_device rd; 45 | std::mt19937 gen(rd()); 46 | std::uniform_int_distribution<> dist(1, 9); 47 | int random_number = dist(gen); 48 | std::stringstream sstr; 49 | sstr << " -" << random_number << " -o " << file_path_upx << " " << file_path; 50 | ssize_t err = kernel_root::safe_root_exec_process(str_root_key, sstr.str().c_str()); 51 | do { 52 | if(err != ERR_NONE) { 53 | break; 54 | } 55 | if(!std::filesystem::exists(file_path_upx)) { 56 | err = ERR_UPX; 57 | break; 58 | } 59 | remove(file_path); 60 | rename(file_path_upx.c_str(), file_path); 61 | 62 | } while(0); 63 | remove(upx_full_path.c_str()); 64 | remove(file_path_upx.c_str()); 65 | return ERR_NONE; 66 | } 67 | 68 | ssize_t safe_upx_file(const char* str_root_key, const char* file_path) { 69 | ssize_t err = ERR_NONE; 70 | fork_pipe_info finfo; 71 | if(fork_pipe_child_process(finfo)) { 72 | err = upx_file(str_root_key, file_path); 73 | write_errcode_from_child(finfo, err); 74 | _exit(0); 75 | return ERR_NONE; 76 | } 77 | if(!wait_fork_child_process(finfo)) { 78 | err = ERR_WAIT_FORK_CHILD; 79 | } else { 80 | if(!read_errcode_from_child(finfo, err)) { 81 | err = ERR_READ_CHILD_ERRCODE; 82 | } 83 | } 84 | return err; 85 | } 86 | 87 | } 88 | 89 | 90 | 91 | -------------------------------------------------------------------------------- /testRoot/jni/kernel_root_kit/kernel_root_kit_upx_helper.h: -------------------------------------------------------------------------------- 1 | #ifndef _KERNEL_ROOT_KIT_UPX_HELPER_H_ 2 | #define _KERNEL_ROOT_KIT_UPX_HELPER_H_ 3 | #include 4 | namespace kernel_root { 5 | ssize_t upx_file(const char* str_root_key, const char* file_path); 6 | 7 | ssize_t safe_upx_file(const char* str_root_key, const char* file_path); 8 | } 9 | #endif /* _KERNEL_ROOT_KIT_UPX_HELPER_H_ */ 10 | -------------------------------------------------------------------------------- /testRoot/jni/lib_root_server/file_to_gzip/file_to_gzip.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include "zlib-1.3.1/zlib.h" 4 | #include 5 | #include 6 | #include 7 | 8 | namespace fs = std::filesystem; 9 | 10 | void gzipCompressFile(const std::string& inputFile, const std::string& outputFile, int compressionLevel) { 11 | std::ifstream input(inputFile, std::ios::binary); 12 | if (!input) { 13 | throw std::runtime_error("Failed to open input file"); 14 | } 15 | std::ofstream output(outputFile, std::ios::binary); 16 | if (!output) { 17 | throw std::runtime_error("Failed to open output file"); 18 | } 19 | z_stream strm; 20 | memset(&strm, 0, sizeof(strm)); 21 | 22 | if (deflateInit2(&strm, compressionLevel, Z_DEFLATED, MAX_WBITS + 16, 8, Z_DEFAULT_STRATEGY) != Z_OK) { 23 | throw std::runtime_error("deflateInit2 failed"); 24 | } 25 | unsigned char inBuffer[1024]; 26 | unsigned char outBuffer[1024]; 27 | int ret; 28 | do { 29 | input.read(reinterpret_cast(inBuffer), sizeof(inBuffer)); 30 | strm.avail_in = static_cast(input.gcount()); 31 | strm.next_in = inBuffer; 32 | 33 | do { 34 | strm.avail_out = sizeof(outBuffer); 35 | strm.next_out = outBuffer; 36 | 37 | ret = deflate(&strm, input.eof() ? Z_FINISH : Z_NO_FLUSH); 38 | if (ret == Z_STREAM_ERROR) { 39 | deflateEnd(&strm); 40 | throw std::runtime_error("deflate failed"); 41 | } 42 | 43 | size_t have = sizeof(outBuffer) - strm.avail_out; 44 | output.write(reinterpret_cast(outBuffer), have); 45 | } while (strm.avail_out == 0); 46 | } while (!input.eof()); 47 | deflateEnd(&strm); 48 | } 49 | 50 | int main(int argc, char* argv[]) { 51 | if (argc < 2) { 52 | std::cerr << "Usage: " << std::endl; 53 | return 1; 54 | } 55 | 56 | std::string inputFile = argv[1]; 57 | fs::path inputFilePath(inputFile); 58 | 59 | if (!fs::exists(inputFile)) { 60 | std::cerr << "Error: File does not exist: " << inputFile << std::endl; 61 | return 1; 62 | } 63 | std::string outputFile = inputFilePath.stem().string() + ".gz.bin"; 64 | 65 | try { 66 | gzipCompressFile(inputFile, outputFile, 9); 67 | std::cout << "Compressed file saved to: " << outputFile << std::endl; 68 | } 69 | catch (const std::exception& e) { 70 | std::cerr << "Error: " << e.what() << std::endl; 71 | return 1; 72 | } 73 | return 0; 74 | } 75 | -------------------------------------------------------------------------------- /testRoot/jni/lib_root_server/file_to_gzip/file_to_gzip.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/testRoot/jni/lib_root_server/file_to_gzip/file_to_gzip.exe -------------------------------------------------------------------------------- /testRoot/jni/lib_root_server/file_to_gzip/file_to_gzip.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 17 4 | VisualStudioVersion = 17.9.34723.18 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "file_to_gzip", "file_to_gzip.vcxproj", "{16207CB0-9A77-4C0C-A138-BCB1CC5B529F}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|x64 = Debug|x64 11 | Debug|x86 = Debug|x86 12 | Release|x64 = Release|x64 13 | Release|x86 = Release|x86 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {16207CB0-9A77-4C0C-A138-BCB1CC5B529F}.Debug|x64.ActiveCfg = Debug|x64 17 | {16207CB0-9A77-4C0C-A138-BCB1CC5B529F}.Debug|x64.Build.0 = Debug|x64 18 | {16207CB0-9A77-4C0C-A138-BCB1CC5B529F}.Debug|x86.ActiveCfg = Debug|Win32 19 | {16207CB0-9A77-4C0C-A138-BCB1CC5B529F}.Debug|x86.Build.0 = Debug|Win32 20 | {16207CB0-9A77-4C0C-A138-BCB1CC5B529F}.Release|x64.ActiveCfg = Release|x64 21 | {16207CB0-9A77-4C0C-A138-BCB1CC5B529F}.Release|x64.Build.0 = Release|x64 22 | {16207CB0-9A77-4C0C-A138-BCB1CC5B529F}.Release|x86.ActiveCfg = Release|Win32 23 | {16207CB0-9A77-4C0C-A138-BCB1CC5B529F}.Release|x86.Build.0 = Release|Win32 24 | EndGlobalSection 25 | GlobalSection(SolutionProperties) = preSolution 26 | HideSolutionNode = FALSE 27 | EndGlobalSection 28 | GlobalSection(ExtensibilityGlobals) = postSolution 29 | SolutionGuid = {8E047BCA-3D16-465C-A987-EB861A4B9497} 30 | EndGlobalSection 31 | EndGlobal 32 | -------------------------------------------------------------------------------- /testRoot/jni/lib_root_server/file_to_gzip/file_to_gzip.vcxproj.filters: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | {d526ab21-3470-4864-a17f-dc15d9c18898} 18 | 19 | 20 | 21 | 22 | 源文件 23 | 24 | 25 | zlib-1.3.1 26 | 27 | 28 | zlib-1.3.1 29 | 30 | 31 | zlib-1.3.1 32 | 33 | 34 | zlib-1.3.1 35 | 36 | 37 | zlib-1.3.1 38 | 39 | 40 | zlib-1.3.1 41 | 42 | 43 | zlib-1.3.1 44 | 45 | 46 | zlib-1.3.1 47 | 48 | 49 | zlib-1.3.1 50 | 51 | 52 | zlib-1.3.1 53 | 54 | 55 | zlib-1.3.1 56 | 57 | 58 | zlib-1.3.1 59 | 60 | 61 | zlib-1.3.1 62 | 63 | 64 | zlib-1.3.1 65 | 66 | 67 | zlib-1.3.1 68 | 69 | 70 | 71 | 72 | zlib-1.3.1 73 | 74 | 75 | zlib-1.3.1 76 | 77 | 78 | zlib-1.3.1 79 | 80 | 81 | zlib-1.3.1 82 | 83 | 84 | zlib-1.3.1 85 | 86 | 87 | zlib-1.3.1 88 | 89 | 90 | zlib-1.3.1 91 | 92 | 93 | zlib-1.3.1 94 | 95 | 96 | zlib-1.3.1 97 | 98 | 99 | zlib-1.3.1 100 | 101 | 102 | zlib-1.3.1 103 | 104 | 105 | -------------------------------------------------------------------------------- /testRoot/jni/lib_root_server/file_to_gzip/file_to_gzip.vcxproj.user: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | -------------------------------------------------------------------------------- /testRoot/jni/lib_root_server/file_to_gzip/zlib-1.3.1/compress.c: -------------------------------------------------------------------------------- 1 | /* compress.c -- compress a memory buffer 2 | * Copyright (C) 1995-2005, 2014, 2016 Jean-loup Gailly, Mark Adler 3 | * For conditions of distribution and use, see copyright notice in zlib.h 4 | */ 5 | 6 | /* @(#) $Id$ */ 7 | 8 | #define ZLIB_INTERNAL 9 | #include "zlib.h" 10 | 11 | /* =========================================================================== 12 | Compresses the source buffer into the destination buffer. The level 13 | parameter has the same meaning as in deflateInit. sourceLen is the byte 14 | length of the source buffer. Upon entry, destLen is the total size of the 15 | destination buffer, which must be at least 0.1% larger than sourceLen plus 16 | 12 bytes. Upon exit, destLen is the actual size of the compressed buffer. 17 | 18 | compress2 returns Z_OK if success, Z_MEM_ERROR if there was not enough 19 | memory, Z_BUF_ERROR if there was not enough room in the output buffer, 20 | Z_STREAM_ERROR if the level parameter is invalid. 21 | */ 22 | int ZEXPORT compress2(Bytef *dest, uLongf *destLen, const Bytef *source, 23 | uLong sourceLen, int level) { 24 | z_stream stream; 25 | int err; 26 | const uInt max = (uInt)-1; 27 | uLong left; 28 | 29 | left = *destLen; 30 | *destLen = 0; 31 | 32 | stream.zalloc = (alloc_func)0; 33 | stream.zfree = (free_func)0; 34 | stream.opaque = (voidpf)0; 35 | 36 | err = deflateInit(&stream, level); 37 | if (err != Z_OK) return err; 38 | 39 | stream.next_out = dest; 40 | stream.avail_out = 0; 41 | stream.next_in = (z_const Bytef *)source; 42 | stream.avail_in = 0; 43 | 44 | do { 45 | if (stream.avail_out == 0) { 46 | stream.avail_out = left > (uLong)max ? max : (uInt)left; 47 | left -= stream.avail_out; 48 | } 49 | if (stream.avail_in == 0) { 50 | stream.avail_in = sourceLen > (uLong)max ? max : (uInt)sourceLen; 51 | sourceLen -= stream.avail_in; 52 | } 53 | err = deflate(&stream, sourceLen ? Z_NO_FLUSH : Z_FINISH); 54 | } while (err == Z_OK); 55 | 56 | *destLen = stream.total_out; 57 | deflateEnd(&stream); 58 | return err == Z_STREAM_END ? Z_OK : err; 59 | } 60 | 61 | /* =========================================================================== 62 | */ 63 | int ZEXPORT compress(Bytef *dest, uLongf *destLen, const Bytef *source, 64 | uLong sourceLen) { 65 | return compress2(dest, destLen, source, sourceLen, Z_DEFAULT_COMPRESSION); 66 | } 67 | 68 | /* =========================================================================== 69 | If the default memLevel or windowBits for deflateInit() is changed, then 70 | this function needs to be updated. 71 | */ 72 | uLong ZEXPORT compressBound(uLong sourceLen) { 73 | return sourceLen + (sourceLen >> 12) + (sourceLen >> 14) + 74 | (sourceLen >> 25) + 13; 75 | } 76 | -------------------------------------------------------------------------------- /testRoot/jni/lib_root_server/file_to_gzip/zlib-1.3.1/gzclose.c: -------------------------------------------------------------------------------- 1 | /* gzclose.c -- zlib gzclose() function 2 | * Copyright (C) 2004, 2010 Mark Adler 3 | * For conditions of distribution and use, see copyright notice in zlib.h 4 | */ 5 | 6 | #include "gzguts.h" 7 | 8 | /* gzclose() is in a separate file so that it is linked in only if it is used. 9 | That way the other gzclose functions can be used instead to avoid linking in 10 | unneeded compression or decompression routines. */ 11 | int ZEXPORT gzclose(gzFile file) { 12 | #ifndef NO_GZCOMPRESS 13 | gz_statep state; 14 | 15 | if (file == NULL) 16 | return Z_STREAM_ERROR; 17 | state = (gz_statep)file; 18 | 19 | return state->mode == GZ_READ ? gzclose_r(file) : gzclose_w(file); 20 | #else 21 | return gzclose_r(file); 22 | #endif 23 | } 24 | -------------------------------------------------------------------------------- /testRoot/jni/lib_root_server/file_to_gzip/zlib-1.3.1/inffast.h: -------------------------------------------------------------------------------- 1 | /* inffast.h -- header to use inffast.c 2 | * Copyright (C) 1995-2003, 2010 Mark Adler 3 | * For conditions of distribution and use, see copyright notice in zlib.h 4 | */ 5 | 6 | /* WARNING: this file should *not* be used by applications. It is 7 | part of the implementation of the compression library and is 8 | subject to change. Applications should only use zlib.h. 9 | */ 10 | 11 | void ZLIB_INTERNAL inflate_fast(z_streamp strm, unsigned start); 12 | -------------------------------------------------------------------------------- /testRoot/jni/lib_root_server/file_to_gzip/zlib-1.3.1/inftrees.h: -------------------------------------------------------------------------------- 1 | /* inftrees.h -- header to use inftrees.c 2 | * Copyright (C) 1995-2005, 2010 Mark Adler 3 | * For conditions of distribution and use, see copyright notice in zlib.h 4 | */ 5 | 6 | /* WARNING: this file should *not* be used by applications. It is 7 | part of the implementation of the compression library and is 8 | subject to change. Applications should only use zlib.h. 9 | */ 10 | 11 | /* Structure for decoding tables. Each entry provides either the 12 | information needed to do the operation requested by the code that 13 | indexed that table entry, or it provides a pointer to another 14 | table that indexes more bits of the code. op indicates whether 15 | the entry is a pointer to another table, a literal, a length or 16 | distance, an end-of-block, or an invalid code. For a table 17 | pointer, the low four bits of op is the number of index bits of 18 | that table. For a length or distance, the low four bits of op 19 | is the number of extra bits to get after the code. bits is 20 | the number of bits in this code or part of the code to drop off 21 | of the bit buffer. val is the actual byte to output in the case 22 | of a literal, the base length or distance, or the offset from 23 | the current table to the next table. Each entry is four bytes. */ 24 | typedef struct { 25 | unsigned char op; /* operation, extra bits, table bits */ 26 | unsigned char bits; /* bits in this part of the code */ 27 | unsigned short val; /* offset in table or code value */ 28 | } code; 29 | 30 | /* op values as set by inflate_table(): 31 | 00000000 - literal 32 | 0000tttt - table link, tttt != 0 is the number of table index bits 33 | 0001eeee - length or distance, eeee is the number of extra bits 34 | 01100000 - end of block 35 | 01000000 - invalid code 36 | */ 37 | 38 | /* Maximum size of the dynamic table. The maximum number of code structures is 39 | 1444, which is the sum of 852 for literal/length codes and 592 for distance 40 | codes. These values were found by exhaustive searches using the program 41 | examples/enough.c found in the zlib distribution. The arguments to that 42 | program are the number of symbols, the initial root table size, and the 43 | maximum bit length of a code. "enough 286 9 15" for literal/length codes 44 | returns 852, and "enough 30 6 15" for distance codes returns 592. The 45 | initial root table size (9 or 6) is found in the fifth argument of the 46 | inflate_table() calls in inflate.c and infback.c. If the root table size is 47 | changed, then these maximum sizes would be need to be recalculated and 48 | updated. */ 49 | #define ENOUGH_LENS 852 50 | #define ENOUGH_DISTS 592 51 | #define ENOUGH (ENOUGH_LENS+ENOUGH_DISTS) 52 | 53 | /* Type of code to build for inflate_table() */ 54 | typedef enum { 55 | CODES, 56 | LENS, 57 | DISTS 58 | } codetype; 59 | 60 | int ZLIB_INTERNAL inflate_table(codetype type, unsigned short FAR *lens, 61 | unsigned codes, code FAR * FAR *table, 62 | unsigned FAR *bits, unsigned short FAR *work); 63 | -------------------------------------------------------------------------------- /testRoot/jni/lib_root_server/file_to_gzip/zlib-1.3.1/uncompr.c: -------------------------------------------------------------------------------- 1 | /* uncompr.c -- decompress a memory buffer 2 | * Copyright (C) 1995-2003, 2010, 2014, 2016 Jean-loup Gailly, Mark Adler 3 | * For conditions of distribution and use, see copyright notice in zlib.h 4 | */ 5 | 6 | /* @(#) $Id$ */ 7 | 8 | #define ZLIB_INTERNAL 9 | #include "zlib.h" 10 | 11 | /* =========================================================================== 12 | Decompresses the source buffer into the destination buffer. *sourceLen is 13 | the byte length of the source buffer. Upon entry, *destLen is the total size 14 | of the destination buffer, which must be large enough to hold the entire 15 | uncompressed data. (The size of the uncompressed data must have been saved 16 | previously by the compressor and transmitted to the decompressor by some 17 | mechanism outside the scope of this compression library.) Upon exit, 18 | *destLen is the size of the decompressed data and *sourceLen is the number 19 | of source bytes consumed. Upon return, source + *sourceLen points to the 20 | first unused input byte. 21 | 22 | uncompress returns Z_OK if success, Z_MEM_ERROR if there was not enough 23 | memory, Z_BUF_ERROR if there was not enough room in the output buffer, or 24 | Z_DATA_ERROR if the input data was corrupted, including if the input data is 25 | an incomplete zlib stream. 26 | */ 27 | int ZEXPORT uncompress2(Bytef *dest, uLongf *destLen, const Bytef *source, 28 | uLong *sourceLen) { 29 | z_stream stream; 30 | int err; 31 | const uInt max = (uInt)-1; 32 | uLong len, left; 33 | Byte buf[1]; /* for detection of incomplete stream when *destLen == 0 */ 34 | 35 | len = *sourceLen; 36 | if (*destLen) { 37 | left = *destLen; 38 | *destLen = 0; 39 | } 40 | else { 41 | left = 1; 42 | dest = buf; 43 | } 44 | 45 | stream.next_in = (z_const Bytef *)source; 46 | stream.avail_in = 0; 47 | stream.zalloc = (alloc_func)0; 48 | stream.zfree = (free_func)0; 49 | stream.opaque = (voidpf)0; 50 | 51 | err = inflateInit(&stream); 52 | if (err != Z_OK) return err; 53 | 54 | stream.next_out = dest; 55 | stream.avail_out = 0; 56 | 57 | do { 58 | if (stream.avail_out == 0) { 59 | stream.avail_out = left > (uLong)max ? max : (uInt)left; 60 | left -= stream.avail_out; 61 | } 62 | if (stream.avail_in == 0) { 63 | stream.avail_in = len > (uLong)max ? max : (uInt)len; 64 | len -= stream.avail_in; 65 | } 66 | err = inflate(&stream, Z_NO_FLUSH); 67 | } while (err == Z_OK); 68 | 69 | *sourceLen -= len + stream.avail_in; 70 | if (dest != buf) 71 | *destLen = stream.total_out; 72 | else if (stream.total_out && err == Z_BUF_ERROR) 73 | left = 1; 74 | 75 | inflateEnd(&stream); 76 | return err == Z_STREAM_END ? Z_OK : 77 | err == Z_NEED_DICT ? Z_DATA_ERROR : 78 | err == Z_BUF_ERROR && left + stream.avail_out ? Z_DATA_ERROR : 79 | err; 80 | } 81 | 82 | int ZEXPORT uncompress(Bytef *dest, uLongf *destLen, const Bytef *source, 83 | uLong sourceLen) { 84 | return uncompress2(dest, destLen, source, &sourceLen); 85 | } 86 | -------------------------------------------------------------------------------- /testRoot/jni/lib_root_server/generate_source_lib_root_server_data.bat: -------------------------------------------------------------------------------- 1 | @echo off 2 | cd /d "%~dp0" 3 | 4 | set "work_path=%~dp0" 5 | set "kernel_root_path=%~dp0../kernel_root_kit" 6 | 7 | echo %work_path% 8 | echo %kernel_root_path% 9 | 10 | if not exist %work_path%libs/arm64-v8a/lib_root_server.so ( 11 | echo Error: '%work_path%libs/arm64-v8a/lib_root_server.so' does not exist! 12 | pause 13 | exit /b 14 | ) 15 | 16 | :: 使用 echo 和管道(|) 来模拟按下回车键的操作 17 | echo.|"%kernel_root_path%/file_convert_to_source_tools/file_convert_to_source_tools.exe" %work_path%/libs/arm64-v8a/lib_root_server.so 18 | 19 | :: 确保上面的命令执行成功，再进行以下的文件替换操作 20 | if %errorlevel% neq 0 ( 21 | echo Error: 'file_convert_to_source_tools.exe' execution failed! 22 | pause 23 | exit /b 24 | ) 25 | 26 | :: 将res.h文件中的文本进行替换 27 | powershell -Command "(Get-Content res.h) -replace 'namespace {', 'namespace kernel_root {' | Set-Content res.h" 28 | powershell -Command "(Get-Content res.h) -replace 'fileSize', 'lib_root_server_file_size' | Set-Content res.h" 29 | powershell -Command "(Get-Content res.h) -replace 'data', 'lib_root_server_file_data' | Set-Content res.h" 30 | 31 | :: 将临时文件重命名为最终的文件名 32 | move /Y res.h kernel_root_kit_lib_root_server_data.h 33 | 34 | if exist res.h ( 35 | del res.h 36 | ) 37 | 38 | if exist "%work_path%\libs" ( 39 | rmdir /S /Q "%work_path%\libs" 40 | ) 41 | 42 | if exist "%work_path%\obj" ( 43 | rmdir /S /Q "%work_path%\obj" 44 | ) 45 | 46 | echo Finished generating the 'kernel_root_kit_lib_root_server_data.h' file! 47 | move /Y kernel_root_kit_lib_root_server_data.h ../kernel_root_kit 48 | echo Successfully moved file 'kernel_root_kit_lib_root_server_data.h'! 49 | -------------------------------------------------------------------------------- /testRoot/jni/lib_root_server/generate_source_lib_root_server_html_data.bat: -------------------------------------------------------------------------------- 1 | @echo off 2 | cd /d "%~dp0" 3 | 4 | set "work_path=%~dp0" 5 | set "kernel_root_path=%~dp0../kernel_root_kit" 6 | 7 | echo %work_path% 8 | echo %kernel_root_path% 9 | 10 | if not exist %work_path%/index.html ( 11 | echo Error: '%work_path%index.html' does not exist! 12 | pause 13 | exit /b 14 | ) 15 | 16 | echo.|"%work_path%/file_to_gzip/file_to_gzip.exe" %work_path%/index.html 17 | 18 | echo.|"%kernel_root_path%/file_convert_to_source_tools/file_convert_to_source_tools.exe" %work_path%/index.gz.bin 19 | 20 | :: 确保上面的命令执行成功，再进行以下的文件替换操作 21 | if %errorlevel% neq 0 ( 22 | echo Error: 'file_convert_to_source_tools.exe' execution failed! 23 | pause 24 | exit /b 25 | ) 26 | 27 | :: 将res.h文件中的文本进行替换 28 | powershell -Command "(Get-Content res.h) -replace 'namespace {', 'namespace lib_root_server {' | Set-Content res.h" 29 | powershell -Command "(Get-Content res.h) -replace 'fileSize', 'index_html_gz_size' | Set-Content res.h" 30 | powershell -Command "(Get-Content res.h) -replace 'data', 'index_html_gz_data' | Set-Content res.h" 31 | 32 | :: 将临时文件重命名为最终的文件名 33 | move /Y res.h index_html_gz_data.h 34 | 35 | if exist res.h ( 36 | del res.h 37 | ) 38 | 39 | if exist index.gz.bin ( 40 | del index.gz.bin 41 | ) 42 | echo Finished generating the 'index_html_gz_data.h' file! 43 | 44 | -------------------------------------------------------------------------------- /testRoot/jni/lib_root_server/jni/Android.mk: -------------------------------------------------------------------------------- 1 | LOCAL_PATH := $(call my-dir) 2 | 3 | include $(CLEAR_VARS) 4 | LOCAL_MODULE := lib_root_server 5 | LOCAL_CPPFLAGS += \ 6 | -std=c++17 \ 7 | -fPIC \ 8 | -fvisibility=hidden \ 9 | -frtti \ 10 | -fexceptions \ 11 | -DLIB_ROOT_SERVER_MODE 12 | LOCAL_C_INCLUDES += \ 13 | $(LOCAL_PATH)/../../ 14 | LOCAL_SRC_FILES := \ 15 | ../lib_root_server.cpp \ 16 | ../../kernel_root_kit/kernel_root_kit_process64_inject.cpp \ 17 | ../../kernel_root_kit/kernel_root_kit_ptrace_arm64_utils.cpp \ 18 | ../../kernel_root_kit/kernel_root_kit_su_install_helper.cpp \ 19 | ../../kernel_root_kit/kernel_root_kit_upx_helper.cpp \ 20 | ../../kernel_root_kit/kernel_root_kit_parasite_app.cpp \ 21 | ../../kernel_root_kit/kernel_root_kit_parasite_patch_elf.cpp \ 22 | ../../utils/cJSON.cpp 23 | include $(BUILD_SHARED_LIBRARY) 24 | #include $(BUILD_EXECUTABLE) 25 | -------------------------------------------------------------------------------- /testRoot/jni/lib_root_server/jni/Application.mk: -------------------------------------------------------------------------------- 1 | APP_ABI := arm64-v8a 2 | APP_STL := c++_static -------------------------------------------------------------------------------- /testRoot/jni/lib_root_server/lib_root_server.h: -------------------------------------------------------------------------------- 1 | #ifndef _ROOT_SERVER_H_ 2 | #define _ROOT_SERVER_H_ 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | 12 | namespace { 13 | std::string ROOT_KEY; 14 | std::string SU_BASE_PATH; 15 | int PORT = 0; 16 | char LOG_FILE[] = {'/','s','d','c','a','r','d','/','r','o','o','t','_','s','e','r','v','e','r','.','l','o','g','\0'}; 17 | void writeToLog(const std::string & message) { 18 | // std::ofstream logFile(LOG_FILE, std::ios::app); 19 | // if (!logFile) { 20 | // std::cerr << "Error opening file" << std::endl; 21 | // return; 22 | // } 23 | // logFile << message << std::endl; 24 | // logFile.close(); 25 | // std::cout << message << std::endl; 26 | } 27 | 28 | std::string GetHttpHead_200(long lLen, bool append_gzip = false) { 29 | std::stringstream sstrHead; 30 | sstrHead << "HTTP/1.1 200 OK\r\n"; 31 | sstrHead << "Access-Control-Allow-Origin: *\r\n"; 32 | sstrHead << "Connection: keep-alive\r\n"; 33 | sstrHead << "Content-Length: " << lLen << "\r\n"; 34 | sstrHead << "Content-Type: text/html; charset=UTF-8\r\n"; 35 | if (append_gzip) { 36 | sstrHead << "Content-Encoding: gzip\r\n"; 37 | } 38 | sstrHead << "\r\n"; 39 | return sstrHead.str(); 40 | } 41 | 42 | } 43 | #endif /* _ROOT_SERVER_H_ */ 44 | -------------------------------------------------------------------------------- /testRoot/jni/lib_root_server/lib_root_server_inline.h: -------------------------------------------------------------------------------- 1 | #ifndef _ROOT_SERVER_INLINE_H_ 2 | #define _ROOT_SERVER_INLINE_H_ 3 | #include 4 | #include 5 | 6 | static volatile const char static_inline_root_key[4096] = { 7 | "e21cb39dc7ba99c986deb830ff8b8141b29764128c47ef71ae2375a53a13b880e63262b0e5596c981a9c4ded86b39674d77632683c35adc163812368eb13e75b" 8 | }; 9 | 10 | static volatile const char static_inline_su_base[4096] = { 11 | "55e624c70f56bd02c08c8ee13548cc9c11f770b1a08b3fd21d6ac086ee2538139a1dd262f6b38dcd60dddb3225059b06a435b89200ede37370201ea0aead4a01" 12 | }; 13 | 14 | #endif /* _ROOT_SERVER_INLINE_H_ */ 15 | -------------------------------------------------------------------------------- /testRoot/jni/lib_su_env/generate_source_lib_su_env_data.bat: -------------------------------------------------------------------------------- 1 | @echo off 2 | cd /d "%~dp0" 3 | 4 | set "work_path=%~dp0" 5 | set "kernel_root_path=%~dp0../kernel_root_kit" 6 | 7 | echo %work_path% 8 | echo %kernel_root_path% 9 | 10 | if not exist %work_path%libs/arm64-v8a/lib_su_env.so ( 11 | echo Error: '%work_path%libs/arm64-v8a/lib_su_env.so' does not exist! 12 | pause 13 | exit /b 14 | ) 15 | 16 | :: 使用 echo 和管道(|) 来模拟按下回车键的操作 17 | echo.|"%kernel_root_path%/file_convert_to_source_tools/file_convert_to_source_tools.exe" %work_path%/libs/arm64-v8a/lib_su_env.so 18 | 19 | :: 确保上面的命令执行成功，再进行以下的文件替换操作 20 | if %errorlevel% neq 0 ( 21 | echo Error: 'file_convert_to_source_tools.exe' execution failed! 22 | pause 23 | exit /b 24 | ) 25 | 26 | :: 将res.h文件中的文本进行替换 27 | powershell -Command "(Get-Content res.h) -replace 'namespace {', 'namespace kernel_root {' | Set-Content res.h" 28 | powershell -Command "(Get-Content res.h) -replace 'fileSize', 'lib_su_env_file_size' | Set-Content res.h" 29 | powershell -Command "(Get-Content res.h) -replace 'data', 'lib_su_env_file_data' | Set-Content res.h" 30 | 31 | move /Y res.h kernel_root_kit_lib_su_env_data.h 32 | 33 | 34 | if exist res.h ( 35 | del res.h 36 | ) 37 | 38 | if exist "%work_path%\libs" ( 39 | rmdir /S /Q "%work_path%\libs" 40 | ) 41 | 42 | if exist "%work_path%\obj" ( 43 | rmdir /S /Q "%work_path%\obj" 44 | ) 45 | 46 | echo Finished generating the 'kernel_root_kit_lib_su_env_data.h' file! 47 | move /Y kernel_root_kit_lib_su_env_data.h ../kernel_root_kit 48 | echo Successfully moved file 'kernel_root_kit_lib_su_env_data.h'! 49 | -------------------------------------------------------------------------------- /testRoot/jni/lib_su_env/jni/Android.mk: -------------------------------------------------------------------------------- 1 | LOCAL_PATH := $(call my-dir) 2 | 3 | include $(CLEAR_VARS) 4 | LOCAL_MODULE := lib_su_env 5 | LOCAL_C_INCLUDES += \ 6 | $(LOCAL_PATH)/../../ 7 | LOCAL_CPPFLAGS += -std=c++17 -fPIC -fvisibility=hidden -frtti -fexceptions 8 | LOCAL_SRC_FILES := \ 9 | ../lib_su_env.cpp 10 | include $(BUILD_SHARED_LIBRARY) -------------------------------------------------------------------------------- /testRoot/jni/lib_su_env/jni/Application.mk: -------------------------------------------------------------------------------- 1 | APP_ABI := arm64-v8a 2 | APP_STL := c++_static -------------------------------------------------------------------------------- /testRoot/jni/lib_su_env/lib_su_env.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include "lib_su_env_inline.h" 5 | #include "utils/randomData.h" 6 | 7 | void so_entry() { 8 | char k_path[] = {'P', 'A', 'T', 'H', '\0'}; 9 | std::string who = getenv(k_path); 10 | std::string su_path = const_cast(static_inline_su_folder); 11 | if(who.find(su_path) != std::string::npos) { 12 | return; 13 | } 14 | std::string newWho = su_path; 15 | newWho += ":"; 16 | newWho += who; 17 | setenv(k_path, newWho.c_str(), 1); 18 | } 19 | 20 | extern "C" void __attribute__((constructor)) inject_su_path_entry() { 21 | so_entry(); 22 | } 23 | -------------------------------------------------------------------------------- /testRoot/jni/lib_su_env/lib_su_env_inline.h: -------------------------------------------------------------------------------- 1 | #ifndef _INJECT_SU_PATH_INLINE_SU_PATH_H_ 2 | #define _INJECT_SU_PATH_INLINE_SU_PATH_H_ 3 | #include 4 | #include 5 | 6 | static volatile const char static_inline_su_folder[4096] = { 7 | "c8e275b4fdfb24fb8d146202480377427d9ba1d03864c8b474e7f176648829e8c4014632cb1a1f0fbeb1d637eece7d07f8fad983e27ee99bff49f215177e7463" 8 | }; 9 | 10 | #endif /* _INJECT_SU_PATH_INLINE_SU_PATH_H_ */ 11 | -------------------------------------------------------------------------------- /testRoot/jni/su/generate_source_su_exec_data.bat: -------------------------------------------------------------------------------- 1 | @echo off 2 | cd /d "%~dp0" 3 | 4 | set "work_path=%~dp0" 5 | set "kernel_root_path=%~dp0../kernel_root_kit" 6 | 7 | echo %work_path% 8 | echo %kernel_root_path% 9 | 10 | if not exist %work_path%libs/arm64-v8a/su ( 11 | echo Error: '%work_path%libs/arm64-v8a/su' does not exist! 12 | pause 13 | exit /b 14 | ) 15 | 16 | :: 使用 echo 和管道(|) 来模拟按下回车键的操作 17 | echo.|"%kernel_root_path%/file_convert_to_source_tools/file_convert_to_source_tools.exe" %work_path%/libs/arm64-v8a/su 18 | 19 | :: 确保上面的命令执行成功，再进行以下的文件替换操作 20 | if %errorlevel% neq 0 ( 21 | echo Error: 'file_convert_to_source_tools.exe' execution failed! 22 | pause 23 | exit /b 24 | ) 25 | 26 | :: 将res.h文件中的文本进行替换 27 | powershell -Command "(Get-Content res.h) -replace 'namespace {', 'namespace kernel_root {' | Set-Content res.h" 28 | powershell -Command "(Get-Content res.h) -replace 'fileSize', 'su_exec_file_size' | Set-Content res.h" 29 | powershell -Command "(Get-Content res.h) -replace 'data', 'su_exec_data' | Set-Content res.h" 30 | 31 | :: 将临时文件重命名为最终的文件名 32 | move /Y res.h kernel_root_kit_su_exec_data.h 33 | 34 | if exist res.h ( 35 | del res.h 36 | ) 37 | 38 | if exist "%work_path%\libs" ( 39 | rmdir /S /Q "%work_path%\libs" 40 | ) 41 | 42 | if exist "%work_path%\obj" ( 43 | rmdir /S /Q "%work_path%\obj" 44 | ) 45 | 46 | echo Finished generating the 'kernel_root_kit_su_exec_data.h' file! 47 | move /Y kernel_root_kit_su_exec_data.h ../kernel_root_kit 48 | echo Successfully moved file 'kernel_root_kit_su_exec_data.h'! 49 | 50 | -------------------------------------------------------------------------------- /testRoot/jni/su/jni/Android.mk: -------------------------------------------------------------------------------- 1 | LOCAL_PATH := $(call my-dir) 2 | 3 | include $(CLEAR_VARS) 4 | LOCAL_MODULE := su 5 | LOCAL_SRC_FILES := ../su.cpp 6 | LOCAL_C_INCLUDES += \ 7 | $(LOCAL_PATH)/../../ 8 | LOCAL_CPPFLAGS += -std=c++17 -fPIE -fvisibility=hidden -frtti -fexceptions 9 | LOCAL_LDFLAGS += -fPIE -pie 10 | include $(BUILD_EXECUTABLE) -------------------------------------------------------------------------------- /testRoot/jni/su/jni/Application.mk: -------------------------------------------------------------------------------- 1 | APP_ABI := arm64-v8a 2 | APP_STL := c++_static -------------------------------------------------------------------------------- /testRoot/jni/su/su.h: -------------------------------------------------------------------------------- 1 | #ifndef _SU_H_ 2 | #define _SU_H_ 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | 16 | #include 17 | #include 18 | #include 19 | #include 20 | #include 21 | #include 22 | #include 23 | #include 24 | #include 25 | #include 26 | 27 | #include 28 | #include 29 | #include 30 | #include 31 | #include 32 | #include 33 | #include 34 | #include 35 | #include 36 | 37 | #define DEFAULT_SHELL "/system/bin/sh" 38 | 39 | // Constants for atty 40 | #define ATTY_IN (1 << 0) 41 | #define ATTY_OUT (1 << 1) 42 | #define ATTY_ERR (1 << 2) 43 | 44 | #define UID_ROOT 0 45 | #define UID_SHELL 2000 46 | 47 | #define ROOT_VER_CODE 1 48 | #define ROOT_VERSION "1.0" 49 | 50 | struct su_req_base { 51 | int uid = UID_ROOT; 52 | bool login = false; 53 | bool keepenv = false; 54 | bool mount_master = false; 55 | } __attribute__((packed)); 56 | 57 | struct su_request : public su_req_base { 58 | std::string shell = DEFAULT_SHELL; 59 | std::string command; 60 | }; 61 | 62 | #endif /* _SU_H_ */ 63 | -------------------------------------------------------------------------------- /testRoot/jni/su/su_encryptor.h: -------------------------------------------------------------------------------- 1 | #ifndef _SU_ENCRYPTOR_H_ 2 | #define _SU_ENCRYPTOR_H_ 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | namespace { 9 | static void rand_str(char* dest, int n) { 10 | int i, randno; 11 | char stardstring[63] = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"; 12 | srand((unsigned)time(NULL)); 13 | for (i = 0; i < n; i++) { 14 | randno = rand() % 62; 15 | *dest = stardstring[randno]; 16 | dest++; 17 | } 18 | } 19 | 20 | static std::string encryp_string(const std::string& src, const std::string& key, bool random = true) { 21 | int KeyPos = -1; 22 | int SrcAsc = 0; 23 | time_t t; 24 | 25 | int KeyLen = key.length(); 26 | if (KeyLen == 0) 27 | return ""; 28 | 29 | 30 | int offset; 31 | if(random) { 32 | srand((unsigned)time(&t)); 33 | offset = rand() % 255; 34 | } else { 35 | offset = 128; 36 | } 37 | 38 | std::stringstream ss; 39 | ss << std::hex << std::setw(2) << std::setfill('0') << offset; 40 | 41 | for (int i = 0; i < src.length(); i++) { 42 | SrcAsc = (src[i] + offset) % 255; 43 | 44 | if (KeyPos < KeyLen - 1) 45 | KeyPos++; 46 | else 47 | KeyPos = 0; 48 | 49 | SrcAsc = SrcAsc ^ key[KeyPos]; 50 | 51 | ss << std::hex << std::setw(2) << std::setfill('0') << SrcAsc; 52 | 53 | offset = SrcAsc; 54 | } 55 | return ss.str(); 56 | } 57 | 58 | static std::string uncryp_string(const std::string& src, const std::string& key) { 59 | int KeyLen = key.length(); 60 | if (KeyLen == 0) 61 | return {}; 62 | 63 | int KeyPos = -1; 64 | int offset = 0; 65 | std::string dest; 66 | int SrcAsc = 0; 67 | int TmpSrcAsc = 0; 68 | 69 | std::stringstream ss; 70 | ss << std::hex << src.substr(0, 2); 71 | ss >> offset; 72 | int SrcPos = 2; 73 | while (SrcPos < src.length()) { 74 | ss.clear(); 75 | ss << std::hex << src.substr(SrcPos, 2); 76 | ss >> SrcAsc; 77 | if (KeyPos < KeyLen - 1) 78 | KeyPos++; 79 | else 80 | KeyPos = 0; 81 | 82 | TmpSrcAsc = SrcAsc ^ key[KeyPos]; 83 | 84 | if (TmpSrcAsc <= offset) 85 | TmpSrcAsc = 255 + TmpSrcAsc - offset; 86 | else 87 | TmpSrcAsc = TmpSrcAsc - offset; 88 | 89 | dest += char(TmpSrcAsc); 90 | offset = SrcAsc; 91 | SrcPos += 2; 92 | } 93 | 94 | return dest; 95 | } 96 | } 97 | #endif /* _SU_ENCRYPTOR_H_ */ 98 | -------------------------------------------------------------------------------- /testRoot/jni/su/su_log.h: -------------------------------------------------------------------------------- 1 | #ifndef _LOG_H_ 2 | #define _LOG_H_ 3 | #include 4 | #include 5 | #include 6 | 7 | //安静输出模式 8 | #define QUIET_PRINTF 9 | 10 | #ifdef QUIET_PRINTF 11 | #define SU_PRINTF(fmt, ...) 12 | #else 13 | #define SU_PRINTF(fmt, ...) printf(fmt, ##__VA_ARGS__) 14 | #endif 15 | 16 | #endif /* _LOG_H_ */ 17 | -------------------------------------------------------------------------------- /testRoot/jni/testRoot.h: -------------------------------------------------------------------------------- 1 | #ifndef _TEST_ROOT_H_ 2 | #define _TEST_ROOT_H_ 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | 12 | #include 13 | #include 14 | 15 | #include "kernel_root_kit/kernel_root_kit_umbrella.h" 16 | #include "su/su_hide_path_utils.h" 17 | 18 | 19 | static inline __uid_t my_getfsuid() { 20 | return syscall(SYS_setfsuid, (uid_t)-1); 21 | } 22 | 23 | static inline __gid_t my_getfsgid() { 24 | return syscall(SYS_setfsgid, (gid_t)-1); 25 | } 26 | 27 | static std::string get_capability_info() { 28 | __uid_t ruid, euid, suid; 29 | if (getresuid(&ruid, &euid, &suid) != 0) { 30 | return "FAILED getresuid()"; 31 | } 32 | __gid_t rgid, egid, sgid; 33 | if (getresgid(&rgid, &egid, &sgid) != 0) { 34 | return "FAILED getresgid()"; 35 | } 36 | __uid_t fsuid = my_getfsuid(); 37 | __gid_t fsgid = my_getfsgid(); 38 | 39 | std::stringstream sstrCapInfo; 40 | sstrCapInfo << "Current process identity info:\n" 41 | << "ruid: " << ruid << "\n" 42 | << "rgid: " << rgid << "\n" 43 | << "suid: " << suid << "\n" 44 | << "sgid: " << sgid << "\n" 45 | << "euid: " << euid << "\n" 46 | << "egid: " << egid << "\n" 47 | << "fsuid: " << fsuid << "\n" 48 | << "fsgid: " << fsgid << "\n"; 49 | 50 | long sb = prctl(PR_GET_SECUREBITS); 51 | sstrCapInfo<< "securebits: " << (void*)sb <<"\n"; 52 | 53 | FILE *fp = fopen(("/proc/" + std::to_string(getpid()) + "/status").c_str(), "r"); 54 | if (fp) { 55 | char line[256]; 56 | while (fgets(line, sizeof(line), fp)) { 57 | if (strncmp(line, "CapInh:", 7) == 0 || strncmp(line, "CapPrm:", 7) == 0 || strncmp(line, "CapEff:", 7) == 0 58 | || strncmp(line, "CapBnd:", 7) == 0 || strncmp(line, "CapAmb:", 7) == 0) { 59 | sstrCapInfo << line; 60 | } 61 | } 62 | fclose(fp); 63 | } else { 64 | sstrCapInfo << "Failed to read /proc/[pid]/status for CapAbility.\n"; 65 | } 66 | 67 | fp = popen("getenforce", "r"); 68 | if (fp) { 69 | char cmd[512] = { 0 }; 70 | fread(cmd, 1, sizeof(cmd), fp); 71 | pclose(fp); 72 | sstrCapInfo<< "read system SELinux status:"<< cmd; 73 | } 74 | return sstrCapInfo.str(); 75 | } 76 | 77 | 78 | #endif /* _TEST_ROOT_H_ */ 79 | -------------------------------------------------------------------------------- /testRoot/jni/upx/generate_source_upx_data.bat: -------------------------------------------------------------------------------- 1 | @echo off 2 | cd /d "%~dp0" 3 | 4 | set "work_path=%~dp0" 5 | set "kernel_root_path=%~dp0../kernel_root_kit" 6 | 7 | echo %work_path% 8 | echo %kernel_root_path% 9 | 10 | if not exist %work_path%upx-5.0.1-arm64_linux/upx ( 11 | echo Error: '%work_path%upx-5.0.1-arm64_linux/upx' does not exist! 12 | pause 13 | exit /b 14 | ) 15 | 16 | :: 使用 echo 和管道(|) 来模拟按下回车键的操作 17 | echo.|"%kernel_root_path%/file_convert_to_source_tools/file_convert_to_source_tools.exe" %work_path%upx-5.0.1-arm64_linux/upx 18 | 19 | :: 确保上面的命令执行成功，再进行以下的文件替换操作 20 | if %errorlevel% neq 0 ( 21 | echo Error: 'file_convert_to_source_tools.exe' execution failed! 22 | pause 23 | exit /b 24 | ) 25 | 26 | :: 将res.h文件中的文本进行替换 27 | powershell -Command "(Get-Content res.h) -replace 'namespace {', 'namespace kernel_root {' | Set-Content res.h" 28 | powershell -Command "(Get-Content res.h) -replace 'fileSize', 'upx_file_size' | Set-Content res.h" 29 | powershell -Command "(Get-Content res.h) -replace 'data', 'upx_file_data' | Set-Content res.h" 30 | 31 | move /Y res.h kernel_root_kit_upx_data.h 32 | 33 | if exist res.h ( 34 | del res.h 35 | ) 36 | 37 | echo Finished generating the 'kernel_root_kit_upx_data.h' file! 38 | move /Y kernel_root_kit_upx_data.h ../kernel_root_kit 39 | echo Successfully moved file 'kernel_root_kit_upx_data.h'! 40 | -------------------------------------------------------------------------------- /testRoot/jni/upx/upx-5.0.1-arm64_linux/README: -------------------------------------------------------------------------------- 1 | ooooo ooo ooooooooo. ooooooo ooooo 2 | `888' `8' `888 `Y88. `8888 d8' 3 | 888 8 888 .d88' Y888..8P 4 | 888 8 888ooo88P' `8888' 5 | 888 8 888 .8PY888. 6 | `88. .8' 888 d8' `888b 7 | `YbodP' o888o o888o o88888o 8 | 9 | 10 | The Ultimate Packer for eXecutables 11 | Copyright (c) 1996-2025 Markus Oberhumer, Laszlo Molnar & John Reiser 12 | https://upx.github.io 13 | 14 | 15 | 16 | WELCOME 17 | ======= 18 | 19 | Welcome to UPX ! 20 | 21 | UPX is a free, secure, portable, extendable, high-performance 22 | executable packer for several executable formats. 23 | 24 | 25 | INTRODUCTION 26 | ============ 27 | 28 | UPX is an advanced executable file compressor. UPX will typically 29 | reduce the file size of programs and DLLs by around 50%-70%, thus 30 | reducing disk space, network load times, download times and 31 | other distribution and storage costs. 32 | 33 | Programs and libraries compressed by UPX are completely self-contained 34 | and run exactly as before, with no runtime or memory penalty for most 35 | of the supported formats. 36 | 37 | UPX supports a number of different executable formats, including 38 | Windows programs and DLLs, and Linux executables. 39 | 40 | UPX is free software distributed under the term of the GNU General 41 | Public License. Full source code is available. 42 | 43 | UPX may be distributed and used freely, even with commercial applications. 44 | See the UPX License Agreements for details. 45 | 46 | 47 | SECURITY CONTEXT 48 | ================ 49 | 50 | IMPORTANT NOTE: UPX inherits the security context of any files it handles. 51 | 52 | This means that packing, unpacking, or even testing or listing a file requires 53 | the same security considerations as actually executing the file. 54 | 55 | Use UPX on trusted files only! 56 | 57 | 58 | SHORT DOCUMENTATION 59 | =================== 60 | 61 | 'upx program.exe' will compress a program or DLL. For best compression 62 | results try 'upx --best program.exe' or 'upx --brute program.exe'. 63 | 64 | Please see the file UPX.DOC for the full documentation. The files 65 | NEWS and BUGS also contain various tidbits of information. 66 | 67 | 68 | THE FUTURE 69 | ========== 70 | 71 | - Stay up-to-date with ongoing OS and executable format changes 72 | 73 | - RISC-V 64 for Linux 74 | 75 | - ARM64 for Windows (help wanted) 76 | 77 | - We will *NOT* add any sort of protection and/or encryption. 78 | This only gives people a false feeling of security because 79 | all "protectors" can be broken by definition. 80 | 81 | - Fix all remaining bugs - please report any issues 82 | https://github.com/upx/upx/issues 83 | 84 | 85 | COPYRIGHT 86 | ========= 87 | 88 | Copyright (C) 1996-2025 Markus Franz Xaver Johannes Oberhumer 89 | Copyright (C) 1996-2025 Laszlo Molnar 90 | Copyright (C) 2000-2025 John F. Reiser 91 | 92 | UPX is distributed with full source code under the terms of the 93 | GNU General Public License v2+; either under the pure GPLv2+ (see 94 | the file COPYING), or (at your option) under the GPLv+2 with special 95 | exceptions and restrictions granting the free usage for all binaries 96 | including commercial programs (see the file LICENSE). 97 | 98 | This program is distributed in the hope that it will be useful, 99 | but WITHOUT ANY WARRANTY; without even the implied warranty of 100 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 101 | 102 | You should have received a copy of the UPX License Agreements along 103 | with this program; see the files COPYING and LICENSE. If not, 104 | visit the UPX home page. 105 | 106 | 107 | Share and enjoy, 108 | Markus & Laszlo & John 109 | 110 | 111 | Markus F.X.J. Oberhumer Laszlo Molnar 112 | 113 | 114 | John F. Reiser 115 | 116 | 117 | 118 | [ The term UPX is a shorthand for the Ultimate Packer for eXecutables 119 | and holds no connection with potential owners of registered trademarks 120 | or other rights. ] 121 | -------------------------------------------------------------------------------- /testRoot/jni/upx/upx-5.0.1-arm64_linux/THANKS.txt: -------------------------------------------------------------------------------- 1 | ooooo ooo ooooooooo. ooooooo ooooo 2 | `888' `8' `888 `Y88. `8888 d8' 3 | 888 8 888 .d88' Y888..8P 4 | 888 8 888ooo88P' `8888' 5 | 888 8 888 .8PY888. 6 | `88. .8' 888 d8' `888b 7 | `YbodP' o888o o888o o88888o 8 | 9 | 10 | The Ultimate Packer for eXecutables 11 | Copyright (c) 1996-2025 Markus Oberhumer, Laszlo Molnar & John Reiser 12 | https://upx.github.io 13 | 14 | 15 | .___.. . 16 | | |_ _.._ ;_/ __ 17 | | [ )(_][ )| \_) 18 | -------------------- 19 | 20 | UPX would not be what it is today without the invaluable help of 21 | everybody who was kind enough to spend time testing it, using it 22 | in applications and reporting bugs. 23 | 24 | The following people made especially gracious contributions of their 25 | time and energy in helping to track down bugs, add new features, and 26 | generally assist in the UPX maintainership process: 27 | 28 | Adam Ierymenko 29 | for severals ideas for the Linux version 30 | Andi Kleen and Jamie Lokier 31 | for the /proc/self/fd/X and other Linux suggestions 32 | Andreas Muegge 33 | for the Win32 GUI 34 | Atli Mar Gudmundsson 35 | for several comments on the win32/pe stub 36 | Charles W. Sandmann 37 | for the idea with the stubless decompressor in djgpp2/coff 38 | Ice 39 | for debugging the PE headersize problem down 40 | Jens Medoch 41 | for the ps1/exe format 42 | Joergen Ibsen and d'b 43 | for the relocation & address optimization ideas 44 | John S. Fine 45 | for the new version of the dos/exe decompressor 46 | Kornel Pal 47 | for the EFI support 48 | Lukundoo 49 | for beta testing 50 | Michael Devore 51 | for initial dos/exe device driver support 52 | Oleg V. Volkov 53 | for various FreeBSD specific information 54 | The Owl & G-RoM 55 | for the --compress-icons fix 56 | Ralph Roth 57 | for reporting several bugs 58 | Salvador Eduardo Tropea 59 | for beta testing 60 | Stefan Widmann 61 | for the win32/pe TLS callback support 62 | The WINE project (https://www.winehq.com/) 63 | for lots of useful information found in their PE loader sources 64 | Natascha 65 | -------------------------------------------------------------------------------- /testRoot/jni/upx/upx-5.0.1-arm64_linux/upx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abcz316/SKRoot-linuxKernelRoot/d56fdd17e8089285123adf1b663081cc9de9fffa/testRoot/jni/upx/upx-5.0.1-arm64_linux/upx -------------------------------------------------------------------------------- /testRoot/jni/utils/jsonUtils.h: -------------------------------------------------------------------------------- 1 | #ifndef JSON_ENCODE_UTILS_H_ 2 | #define JSON_ENCODE_UTILS_H_ 3 | #include 4 | #include 5 | #include 6 | #include "cJSON.h" 7 | 8 | static std::string CreateJsonBody(const std::vector>& keyValuePairs) { 9 | cJSON *root = cJSON_CreateObject(); 10 | if(!root) { 11 | return {}; 12 | } 13 | for (const auto& pair : keyValuePairs) { 14 | cJSON_AddItemToObject(root, std::get<0>(pair).c_str(), cJSON_CreateString(std::get<1>(pair).c_str())); 15 | } 16 | 17 | char *json = cJSON_Print(root); 18 | std::string jsonStr(json); 19 | free(json); 20 | cJSON_Delete(root); 21 | return jsonStr; 22 | } 23 | 24 | static std::string GetMiddleJsonString(std::string_view text) { 25 | std::string jsonString; 26 | int jsonStart = text.find("{"); 27 | int jsonEnd = text.find_last_of("}"); 28 | if(jsonStart != std::string::npos && jsonEnd != std::string::npos) { 29 | jsonString = text.substr(jsonStart, jsonEnd - jsonStart + 1); 30 | } 31 | return jsonString; 32 | } 33 | 34 | #endif -------------------------------------------------------------------------------- /testRoot/jni/utils/stringUtils.h: -------------------------------------------------------------------------------- 1 | #ifndef STRING_UTILS_H_ 2 | #define STRING_UTILS_H_ 3 | #include 4 | #include 5 | 6 | static void replaceAllOccurrences(std::string& str, const std::string& toSearch, const std::string& replaceWith) { 7 | size_t pos = str.find(toSearch); 8 | while(pos != std::string::npos) { 9 | str.replace(pos, toSearch.length(), replaceWith); 10 | pos = str.find(toSearch, pos + replaceWith.length()); 11 | } 12 | } 13 | #endif -------------------------------------------------------------------------------- /testRoot/jni/编译流程.txt: -------------------------------------------------------------------------------- 1 | 1.修改Build.bat第一行为ndk路径 2 | 2.运行Build.bat --------------------------------------------------------------------------------